OpenWRT’s default SSH server daemon is dropbear which may not be vulnerable to the password authentication bypass flaw exploitable in OpenSSH.
OpenWRT openssh-server package is vulnerable because OpenWRT uses musl libc and the package is built without PAM. At least both of these two conditions are required to be exploited. Check if the package is installed apk list --installed openssh-server, if so, update it to 10.6_p2.
apk update
apk add openssh-server
If update is not available due to offline environment or end-of-life OpenWRT version, a mitigation is to disable SSH password authentication, which is highly recommended even when using dropbear. This does not affect password authentication in LuCI web portal http://192.168.1.1.
In LuCI, navigate to System > Administration > SSH-Keys tab (/admin/system/admin/sshkeys), ensure there is at least one functioning (public) key. If not, generate one with ssh-keygen -t ed25519, paste the content of *.pub to the tab and try to SSH using the private key ssh [email protected] -i private.key.
Once SSH key authentication is configured and verified working, proceed with disabling password authentication.
In LuCI, navigate to System > Administration > SSH Access tab (/admin/system/admin/dropbear) > untick “Password authentication” > Save & Apply.
If UCI/CLI is preferred,
uci set dropbear.main.PasswordAuth='off'
uci set dropbear.main.RootPasswordAuth='off'
uci commit dropbear
service dropbear restart
