CVE-2021-27137
DD-WRT Stack-Based Buffer Overflow
- Published16 Jul 2026
- Added to CISA KEV21 Jul 2026
- Remediation due24 Jul 2026
Description
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
References
- https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html
- https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/
- https://svn.dd-wrt.com/changeset/45724
- https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137
- https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2021-27137 being actively exploited?
Yes. CVE-2021-27137 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 21 Jul 2026.
How severe is CVE-2021-27137?
CVE-2021-27137 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 4.00% probability of exploitation.
Which products are affected by CVE-2021-27137?
Affected products include Dd-wrt.
How do I fix CVE-2021-27137?
Upgrade affected software to a fixed version, for example Dd-wrt 45724 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2021-27137 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.