An unauthenticated stack-based buffer overflow in DD-WRT's UPnP handling allows remote code execution and is now confirmed by CISA as actively exploited, with a July 24, 2026 federal remediation deadline.
What Is It
CVE-2021-27137 is a stack-based buffer overflow (CWE-121) in DD-WRT, the open-source router firmware. The flaw lives in router/upnp/src/ssdp.c, where an unsafe strcpy in the UPnP handling code lets an unauthenticated remote attacker send a crafted request that overflows an internal fixed buffer. The overflow is reachable via the ssdp_msearch function, triggered by an M-SEARCH request, and can lead to code execution. It carries a CVSS 3.1 base score of 8.1 (HIGH), vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on July 21, 2026. CISA's SSVC (Stakeholder-Specific Vulnerability Categorization) assessment marks exploitation status as "active" with a technical impact of "total." Successful exploitation gives an unauthenticated attacker full compromise of the affected router. Public reporting linked in the source references ties the flaw to the C0xmo/Gafgyt IoT botnet, which spreads via the DD-WRT flaw and kills rival malware. Known ransomware campaign use is listed as "Unknown."
What's Vulnerable
All DD-WRT firmware versions before revision 45724 are affected (cpe:2.3:o:dd-wrt:dd-wrt). Exploitation requires that the DD-WRT user has enabled UPnP, which is off by default and only listens on internal interfaces by default. Attack complexity is rated HIGH.
Patch Status
DD-WRT fixed the issue in changeset 45724. Per CISA's required action, apply mitigations in accordance with vendor instructions, complying with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The federal remediation due date is July 24, 2026.
Sources
- CISA KEV Catalog; CVE-2021-27137
- NVD, CVE-2021-27137
- DD-WRT Patch; Changeset 45724
- SSD Advisory; DD-WRT UPnP Buffer Overflow
- BleepingComputer; C0xmo botnet spreads via DD-WRT router flaw
- Fortinet; Cross-platform propagation of new Gafgyt variant C0xmo
- BOD 26-04; Prioritizing Security Updates Based on Risk