OpenWRT’s default SSH server daemon is dropbear which may not be vulnerable to the password authentication bypass flaw exploitable in OpenSSH.

OpenWRT openssh-server package is vulnerable because OpenWRT uses musl libc and the package is built without PAM. At least both of these two conditions are required to be exploited. Check if the package is installed apk list --installed openssh-server, if so, update it to 10.6_p2.

apk update
apk add openssh-serverCopy

If update is not available due to offline environment or end-of-life OpenWRT version, a mitigation is to disable SSH password authentication, which is highly recommended even when using dropbear. This does not affect password authentication in LuCI web portal http://192.168.1.1.