{"id":"CVE-2021-27137","published":"2026-07-16T18:16:39Z","modified":"2026-07-22T05:17:07Z","title":"DD-WRT Stack-Based Buffer Overflow Vulnerability","vendor":"DD-WRT","product":"DD-WRT","tier":"core","eol":null,"description":{"text":"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).","provenance":"source","from":"NVD"},"summary":{"text":"DD-WRT contains a stack-based buffer overflow in the UPnP handling code (router/upnp/src/ssdp.c) before version 45724, where an unsafe strcpy in the ssdp_msearch function can be overflowed by a crafted M-SEARCH request. An unauthenticated remote attacker can trigger it without user interaction, but only if the UPnP service has been enabled by the user, which is off by default and listens only on internal interfaces by default.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:30Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.03995,"percentile":0.90492,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-07-21","dueDate":"2026-07-24","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-06-03","exploitedFirstSeen":"2026-06-03","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","date":"2026-06-03"},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","date":"2026-07-10"},{"url":"https://previdian.com/CVE-2021-27137","date":"2026-07-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-07-21"},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","date":"2026-08-07"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":35,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","tags":["Exploit","Third Party Advisory"]},{"url":"https://svn.dd-wrt.com/changeset/45724","tags":["Patch"]},{"url":"https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","tags":["Exploit"]},{"url":"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote request to exposed UPnP service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker","start":74,"end":167}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Buffer overflow yields code execution on router","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer","start":126,"end":230}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-34854","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34854","exploited":true,"exploitedSince":"2026-07-21","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html","https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/","https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"related","techniques":["T1203"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2026-06-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","provenance":"source"},{"date":"2026-07-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27137","provenance":"source"},{"date":"2026-07-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-07-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34854","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":5},"priority":{"score":71.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 148 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.1,"detail":"percentile 0.9049"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"35 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}