Confirmed for default OpenWrt: Dropbear is not affected. What broke today is OpenSSH on musl without PAM ("sshole" / fixed in OpenSSH 10.6p2, released 2026-11-05):

OpenSSH: Release Notes

OpenSSH release notes

and the write-up at

*sshole · sshhole.com

openssh on musl linux has been letting people into password-less accounts since 2016.

— a long password (about 257–1024 bytes) can make musl crypt() return "*", which matches a shadow field of "*" and lets sshd accept a login on accounts that were meant to be password-disabled. sshhole.com's own checklist explicitly marks Dropbear as fine. OpenWrt ships Dropbear as the default SSH server, so stock installs are outside the bug. The only OpenWrt case that matters is if you installed and are running the OpenSSH server package yourself: then update to 10.6p2 (or set PasswordAuthentication no) the same as Alpine. Hacker News / The Hacker News coverage today also notes Kültekin called out OpenWrt as a musl platform to check, while stating Dropbear is not affected.