If I have an OpenWRT with default install, do I need to update, if we only count the threat from WAN/Internet side?
If it really is "default", then no update is required: OpenWRT has always used uClibc for its libc by default, it will not be vulnerable if so.
However, OpenWRT also supports glibc (and musl, which will be the default in the next release), so it is possible to have a vulnerable OpenWRT. Given the size and complexity of glibc, it's most likely that memory/storage constrained devices will not run a glibc version.
If you have a shell on the system, this should be useful: https://unix.stackexchange.com/questions/120380/what-c-library-version-does-my-system-use
If you built/configured it yourself, check
CONFIG_LIBC in the
.config in your build directory. Otherwise, check with the provider of the OpenWRT installation.
(It is also possible, though very unlikely, to have multiple libc instances. The OpenWRT build system does not support this though.)