CVE-2021-27137
DD-WRT Stack-Based Buffer Overflow Vulnerability
Description
CVE-2021-27137 is a stack-based buffer overflow in the UPnP handling functionality of DD-WRT, the open-source router firmware. An unsafe strcpy in router/upnp/src/ssdp.c lets an unauthenticated remote attacker send an SSDP M-SEARCH request that overflows an internal fixed-size buffer inside ssdp_msearch, which on an embedded router means control over stack memory and, with it, the device. Versions before build 45724 are affected. Exploitation requires the DD-WRT user to have enabled UPnP, which is off by default and only listens on internal interfaces by default — this is why the CVSS score is 8.1 (High) with high attack complexity rather than a straight 9.8. CISA added CVE-2021-27137 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-24, and public research links this DD-WRT vulnerability to active botnet propagation, so the age of the CVE is no indication of how current the risk is.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dd-wrt | dd-wrt | < 45724 |
References
- https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html(Exploit, Third Party Advisory)
- https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/(Exploit, Third Party Advisory)
- https://svn.dd-wrt.com/changeset/45724(Patch)
- https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/(Exploit, Third Party Advisory)
- https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
Stack-based Buffer Overflow occurs when a buffer allocated on the stack is written with more data than it can hold, overwriting adjacent stack contents such as saved return addresses and frame pointers, which lets an attacker redirect program execution. In DD-WRT the UPnP SSDP handler copies attacker-supplied request data into a fixed-size local buffer with strcpy, a function that performs no bounds checking at all, so an oversized M-SEARCH request writes past the end of the buffer and corrupts the stack frame of ssdp_msearch.
Learn more: CWE-121 — Stack-based Buffer Overflow
Impact Analysis
CVE-2021-27137 has a CVSS 3.1 base score of 8.1 (High): it is remotely exploitable without physical access, requires no authentication, and needs no user action, while the high attack complexity metric reflects the configuration precondition that UPnP must be enabled and reachable, plus the memory-corruption work needed to turn the overflow into reliable execution. Confidentiality (High): control over the router exposes the traffic it forwards, its configuration, and any stored credentials such as WAN and wireless secrets. Integrity (High): an attacker can rewrite firewall and DNS settings, redirect clients, or install persistent malware in the firmware environment. Availability (High): corrupting the stack can crash the UPnP service or the device, and an attacker with control can simply disable the router. The device class is what makes this significant: a compromised router sits between every client on the network and the internet, and the referenced research describes the flaw being used for botnet propagation, meaning exploitation is not aimed at a single target but at scale.
Exploit Maturity
CVE-2021-27137 is being exploited: CISA lists it in the Known Exploited Vulnerabilities catalog with a due date of 2026-07-24, and ransomware use is currently marked as Unknown. Public exploit material is available for CVE-2021-27137 through the original technical disclosure at SSD Secure Disclosure, which documents the DD-WRT UPnP buffer overflow, and multiple threat-research references tie the flaw to real malware activity: reporting on the c0xmo IoT botnet at Security Affairs and BleepingComputer describes the botnet spreading via a DD-WRT router flaw and removing rival malware, and Fortinet's analysis of the Gafgyt variant c0xmo examines its cross-platform propagation. The EPSS score of 16.5% (96.7th percentile) is high for a five-year-old CVE and reflects that automated exploitation is ongoing rather than historical. The practical assessment: if UPnP is enabled on an affected DD-WRT build, act now — botnet operators are scanning for exactly this configuration.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-24.
- Update DD-WRT to a build newer than 45724, which contains the fix; the change is published as DD-WRT changeset 45724. Devices running community or vendor-specific DD-WRT images should be checked individually, as build numbers vary between hardware targets.
- Disable UPnP on the router unless it is genuinely required. UPnP is off by default in DD-WRT and only listens on internal interfaces by default, so the exploitable configuration is one that was changed deliberately — reverting it removes the attack surface entirely without any firmware change.
- If UPnP must remain enabled, verify that the SSDP service is not reachable from the WAN interface, block inbound UDP port 1900 at the network edge, and restrict which internal segments may reach the service, since the overflow is triggered by an M-SEARCH request.
- Treat routers that ran an affected build with WAN-facing UPnP as potentially compromised: review DNS and firewall settings for unauthorised changes, look for unexpected outbound connections, reflash the firmware rather than upgrading in place if compromise is suspected, and rotate administrative and wireless credentials. As long-term hardening against stack-based buffer overflows (CWE-121), rely on size-bounded string functions instead of
strcpy, enable compiler protections such as stack canaries and ASLR on embedded builds, and subject network-facing parsers to fuzzing.
Technical Details
The defect behind CVE-2021-27137 is a single unsafe strcpy in router/upnp/src/ssdp.c within DD-WRT's UPnP implementation, reached through ssdp_msearch, the handler for SSDP M-SEARCH discovery requests. strcpy copies until it encounters a null terminator and performs no length validation, so a request longer than the internal fixed-size buffer writes beyond it and overwrites adjacent stack data, including the saved return address that governs where execution continues after the function returns (CWE-121). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H captures the situation: the attack is delivered over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), and confidentiality, integrity, and availability are all impacted at High because control of the router process on an embedded system generally equals control of the device. The AC:H rating encodes two real conditions: UPnP must be enabled by the operator, since DD-WRT ships with it disabled and bound to internal interfaces only, and stack corruption on a MIPS or ARM router target requires the attacker to build a working payload for that architecture. All DD-WRT builds before 45724 contain the vulnerable copy.
Frequently Asked Questions
Is CVE-2021-27137 being actively exploited?
Yes. CVE-2021-27137 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-07-24, and published threat research attributes DD-WRT router compromise to the c0xmo IoT botnet, a Gafgyt variant. Ransomware usage is currently marked as Unknown, and the EPSS score of 16.5% places the CVE in the 96.7th percentile, which is unusually high for a vulnerability disclosed in 2021.
What products are affected by CVE-2021-27137?
The vulnerability affects DD-WRT router firmware in all builds before 45724. The vulnerable code is in the UPnP component router/upnp/src/ssdp.c, so exploitation additionally requires that the DD-WRT user has enabled UPnP; it is disabled by default and, when enabled, listens only on internal interfaces by default.
How do I fix CVE-2021-27137?
Update DD-WRT to a build newer than 45724, which includes the fix published as DD-WRT changeset 45724. The fastest mitigation is to disable UPnP altogether, and if it must stay enabled, ensure the SSDP service on UDP port 1900 is not reachable from the WAN and rotate router credentials if the device was exposed.
How severe is CVE-2021-27137?
CVE-2021-27137 is rated High with a CVSS 3.1 base score of 8.1: unauthenticated and remote, with high impact on confidentiality, integrity, and availability, but with high attack complexity because UPnP must be enabled and the memory corruption must be weaponised for the router's architecture. On a device that controls all traffic for a network, successful exploitation is effectively a full compromise, and confirmed botnet use shows the barrier has already been cleared in practice.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.