DD-WRT Stack-Based Buffer Overflow Vulnerability (CVE-2021-27137)

What is affected, what to do

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default).

The vulnerability is being actively exploited; treat it as a priority. Update DD-WRT to version 45724. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• DD-WRT lt *..45724

Fixed in

• DD-WRT 45724

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Disable UPnP on every DD-WRT router immediately (Web UI → NAT/QoS → UPnP → Disable). Since UPnP is off by default, this is the fastest kill switch for CVE-2021-27137.
   • Upgrade firmware to DD-WRT build 45724 or later. Check current build under Administration → Management; download images from dd-wrt.com/site/support/router-database and verify the hash against the vendor release.
   • If patching cannot happen now, block UDP/1900 (SSDP) on WAN and on any untrusted internal segment via iptables (iptables -I INPUT -p udp --dport 1900 -j DROP). M-SEARCH packets are the trigger vector reaching ssdp_msearch.
   • Build an inventory of DD-WRT-based devices, including consumer hardware flashed with DD-WRT in branches, home-office routers tunnelling into corporate VPNs, and KRITIS auxiliary sites. These assets routinely fall outside central patch management.
   • Remove management interfaces (HTTP/HTTPS/SSH) of affected routers from the WAN and restrict them to a dedicated management VLAN to limit post-exploitation lateral access.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: DD-WRT routers must not have routing paths into production server VLANs. Egress filters at the upstream perimeter block reverse shells (outbound non-whitelisted ports).
   • IPS/firewall rule: drop SSDP M-SEARCH packets with oversized ST or MAN headers (> 256 bytes). Suricata idea: alert udp any any -> any 1900 (msg:"CVE-2021-27137 oversized SSDP M-SEARCH"; content:"M-SEARCH"; depth:8; dsize:>512; sid:1000001;).
   • Endpoint hardening: disable UPnP globally unless there is a documented business need. Where UPnP must run, bind it strictly to internal, trusted interfaces (DD-WRT: upnpd -L on br0 only, never vlan2/WAN).
   • IAM/access control: enforce strong credentials and RADIUS-backed 2FA on router admin accounts so that a compromised router cannot pivot via credential reuse into AD.
   • Config baseline: use Ansible/rConfig to centrally verify that the UPnP service is disabled and no ssdp listener is bound to external interfaces (netstat -lnp | grep 1900).
   • Lifecycle: devices without an upgrade path (end-of-life hardware with no 45724 build) must enter a replacement plan; NIS2 requires documented risk treatment for such legacy systems.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek): alert on UDP/1900 packets > 500 bytes or M-SEARCH with non-RFC-conformant headers. Filter event ssdp_message for oversized payloads.
   • IDS/Suricata: enable Emerging Threats signatures covering SSDP buffer overflows; custom rule triggering on content:"M-SEARCH"; pcre:"/[^\r\n]{400,}/";.
   • Router syslog: forward ssdp/upnpd process crashes (Segmentation fault, child process ... killed) to the SIEM via remote syslog; repeated upnpd restarts are a strong exploitation indicator.
   • EDR/flow analysis: correlate unusual outbound connections originating from the router itself (SSH, reverse TCP on high ports toward the Internet) after an M-SEARCH burst. KQL sketch: NetworkEvents | where SrcIp in (RouterAssets) | where DstPort !in (53,123,443) | where TimeGenerated > ssdp_event_time.
   • Config drift monitoring: daily diff of router configuration; unexpected UPnP enablement, new iptables rules, or newly created user accounts open a ticket.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

Source: CISA KEV Catalog, cvelistv5, NVD (NIST)

Vendors and products

• DD-WRT DD-WRT

Weakness classes (CWE)

• CWE-121Stack-based Buffer Overflow

  Variant

  A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

  Entry at MITRE CWE-121

References & sources

• svn.dd-wrt.comchangeset/45724
• ssd-disclosure.comssd-advisory-dd-wrt-upnp-buffer-overflow
• securityaffairs.com193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-c…
• bleepingcomputer.comnews/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills…
• fortinet.comblog/threat-research/inside-cross-platform-propagation-of-new-g…
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 22.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2021-27137","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T15:45:25.742968Z"}	{"id":"CVE-2021-27137","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 21.07.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • DD-WRT (before 45724)

   New references:

   • https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html
   • https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/
   • https://svn.dd-wrt.com/changeset/45724
   • https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/

   and 2 more references

   Show 8 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:o:dd-wrt:dd-wrt:*:*:*:*:*:*:*:* versions up to (excluding) 45724
   Reference type	added	—	MITRE: https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html Types: Exploit, Third Party Advisory
   Reference type	added	—	MITRE: https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/ Types: Exploit, Third Party Advisory
   Reference type	added	—	MITRE: https://svn.dd-wrt.com/changeset/45724 Types: Patch
   Reference type	added	—	MITRE: https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/ Types: Exploit, Third Party Advisory
   Reference type	added	—	MITRE: https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo Types: Exploit
   Reference type	added	—	CISA-ADP: https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/ Types: Exploit, Third Party Advisory
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137 Types: US Government Resource

   Source identifier: nvd@nist.gov

3. 21.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137
   SSVC assessment	changed	{"id":"CVE-2021-27137","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-16T18:24:17.054985Z"}	{"id":"CVE-2021-27137","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T15:45:25.742968Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 21.07.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-07-21
   Due Date	added	—	2026-07-21
   Required Action	added	—	2026-07-21
   Vulnerability Name	added	—	2026-07-21

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

Linked advisories

• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29SANS @RISK30.07.2026
• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28SANS @RISK23.07.2026