(my router is not vulnerable) But, many routers running openwrt seemingly are and if i am not mistaken so is a whole lot of products based on openwrt.
November 5, 2026 at 11:26 PM
(my router is not vulnerable) But, many routers running openwrt seemingly are and if i am not mistaken so is a whole lot of products based on openwrt.
WTF, I have a travel router based on OpenWrt.
November 5, 2026 at 11:31 PM
WTF, I have a travel router based on OpenWrt.
if there were ever a reason for ordinary people to start using openwrt..
“By analyzing how radio waves bounce around a room, researchers can effectively ‘see’ and recognize individuals — even if they are not carrying a device and even if their phone is turned off.”
In tests of 197 participants, the system identified individuals with nearly 100% accuracy.
In tests of 197 participants, the system identified individuals with nearly 100% accuracy.
Ordinary WiFi can now identify people with near perfect accuracy
Scientists in Germany have demonstrated a startling new form of surveillance: identifying people using nothing more than ordinary WiFi signals. By analyzing how radio waves bounce around a room, resea...
www.sciencedaily.com
November 6, 2026 at 5:18 AM
if there were ever a reason for ordinary people to start using openwrt..
afaict it doesnt affect openwrt by default
which uses dropbear instead of openssh-server
still a wild bug though x_x
which uses dropbear instead of openssh-server
still a wild bug though x_x
November 5, 2026 at 1:34 PM
afaict it doesnt affect openwrt by default
which uses dropbear instead of openssh-server
still a wild bug though x_x
which uses dropbear instead of openssh-server
still a wild bug though x_x
Flipping a grunt?
November 5, 2026 at 11:02 PM
Flipping a grunt?
If you have any Linux that uses musl libc and openssh, disconnect it, investigate it, fix it. In that order.
Certainly Alpine, but this could be Gentoo, Void, Dragora and others.
OpenWRT generally uses a different SSH implementation (dropbear).
Certainly Alpine, but this could be Gentoo, Void, Dragora and others.
OpenWRT generally uses a different SSH implementation (dropbear).
November 5, 2026 at 4:20 PM
If you have any Linux that uses musl libc and openssh, disconnect it, investigate it, fix it. In that order.
Certainly Alpine, but this could be Gentoo, Void, Dragora and others.
OpenWRT generally uses a different SSH implementation (dropbear).
Certainly Alpine, but this could be Gentoo, Void, Dragora and others.
OpenWRT generally uses a different SSH implementation (dropbear).
Chat is it good if any long password works on root? sshhole.com (absolutely incredible name for this vulnerability, too.)
November 5, 2026 at 3:15 PM
Chat is it good if any long password works on root? sshhole.com (absolutely incredible name for this vulnerability, too.)
Ok so I HAVE run openwrt in my lifetime (not recently but) guess I need to look at this one more closely. 🫠
November 5, 2026 at 1:52 PM
Ok so I HAVE run openwrt in my lifetime (not recently but) guess I need to look at this one more closely. 🫠
how do I help make the openwrt table of hardware render faster
November 7, 2026 at 8:52 PM
how do I help make the openwrt table of hardware render faster
I keep seeing people FUD about openwrt with it, even though that uses dropbear by default
November 5, 2026 at 5:01 PM
I keep seeing people FUD about openwrt with it, even though that uses dropbear by default
Has anyone using dropbear SSH (ie on OpenWRT) figured out if they're affected, too?
November 6, 2026 at 6:55 AM
Has anyone using dropbear SSH (ie on OpenWRT) figured out if they're affected, too?
Openwrt usually uses dropbear for ssh, openssh would only be on specially configured ones
November 5, 2026 at 4:50 PM
Openwrt usually uses dropbear for ssh, openssh would only be on specially configured ones
Alpine and OpenWRT are trivial to `ssh root@your_thing`, if you have SSH-based password auth on, according to this.
Uh oh
Uh oh
November 5, 2026 at 1:45 PM
Alpine and OpenWRT are trivial to `ssh root@your_thing`, if you have SSH-based password auth on, according to this.
Uh oh
Uh oh
November 6, 2026 at 8:19 PM
OpenWrtとかYoctoにopenssh入れてるとかわりとありそうでこわいな
sshole まじでうんこだなこりゃ sshhole.com
身の周りにalpine + ssh なんてものはないよな...
身の周りにalpine + ssh なんてものはないよな...
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 6, 2026 at 12:48 AM
OpenWrtとかYoctoにopenssh入れてるとかわりとありそうでこわいな
Scheinbar ist es zu viel. Einen Teltonika RUT276 basierend auf OpenWrt gibt es ab 300 Euro...
November 3, 2026 at 9:24 PM
Scheinbar ist es zu viel. Einen Teltonika RUT276 basierend auf OpenWrt gibt es ab 300 Euro...
OpenWRT shouldn't be in this list, as its SSH uses Dropbear by default, which isn't susceptible to this hole. Only a customized sshd configuration forcing OpenSSH would be.
I checked.
I checked.
Chat is it good if any long password works on root? sshhole.com (absolutely incredible name for this vulnerability, too.)
November 6, 2026 at 5:27 AM
OpenWRT shouldn't be in this list, as its SSH uses Dropbear by default, which isn't susceptible to this hole. Only a customized sshd configuration forcing OpenSSH would be.
I checked.
I checked.
Sure, fine, technically true - but e.g. how many people go out of their way to replace dropbear with openssh on openwrt?
November 5, 2026 at 6:13 PM
Sure, fine, technically true - but e.g. how many people go out of their way to replace dropbear with openssh on openwrt?
OpenWRT? Oh that ain't good
Get root on a musl Linux system by slamming it with an overly long password
Decade-old vulnerability in OpenSSH is now fixed, so get a-patchin'
www.theregister.com
November 5, 2026 at 6:39 PM
OpenWRT? Oh that ain't good
> Since 2016, systems like Alpine and OpenWrt have accepted any password longer than 256 characters.
Yeah, no. OpenWrt uses Dropbear, not OpenSSH.
Yeah, no. OpenWrt uses Dropbear, not OpenSSH.
November 5, 2026 at 11:34 PM
> Since 2016, systems like Alpine and OpenWrt have accepted any password longer than 256 characters.
Yeah, no. OpenWrt uses Dropbear, not OpenSSH.
Yeah, no. OpenWrt uses Dropbear, not OpenSSH.