CVE-2021-27137 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-16

Added to CISA KEV: 2026-07-21 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV with confirmed c0xmo/Gafgyt botnet exploitation. Inspect routers for unexpected processes, outbound C2 connections, altered DNS/firewall rules, and firmware tampering; assume full compromise if UPnP was WAN-exposed.
Immediately upgrade DD-WRT to build 45724 or later to remediate the vulnerable strcpy.
If patching is not immediate, disable UPnP and verify the SSDP service (UDP 1900) is not bound to or reachable on the WAN/internet-facing interface; block inbound UDP 1900 at the perimeter.
Monitor for inbound M-SEARCH UDP packets to the SSDP listener and anomalous router behavior; audit UPnP configuration across all managed devices.
Patch priority: HIGH — actively exploited KEV entry; treat as urgent for any device where UPnP may be enabled or WAN-exposed.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2021-27137 is a stack-based buffer overflow vulnerability (CWE-121) residing in the SSDP (Simple Service Discovery Protocol) handler within the `ssdp.c` component of DD-WRT firmware. The vulnerability is triggered by an unsafe `strcpy` operation that copies the `uuid` field from an incoming UPnP M-SEARCH UDP packet into a fixed 128-byte stack buffer without performing any length checks. Because it allows an unauthenticated remote attacker to overwrite adjacent stack memory, it represents a critical security risk for affected networking devices.

Exploitation

Active Exploitation: The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog, indicating it has been exploited in the wild.
Threat Actors: Specific threat actors or ransomware campaigns linked to this vulnerability were not explicitly detailed in the available documentation, though it is categorized as a routinely exploited vulnerability.
Proof-of-Concept: Public information confirms the flaw involves sending a specially crafted, oversized `uuid` value in an M-SEARCH UDP packet to trigger the buffer overflow.
Prerequisites:

- Network: Attack is remote but requires the ability to send UDP packets to the target device. - Authentication: None required (unauthenticated). - User Interaction: None required. - Configuration: The vulnerability only exists if UPnP is enabled on the device. While disabled by default, it may be exposed if the device owner has manually reconfigured it to listen on internet-facing interfaces.

Affected Products & Patches

Affected Versions: DD-WRT firmware versions prior to build 45724.
Patches/Hotfixes: Users are advised to upgrade to a DD-WRT build version 45724 or later to remediate this issue.
Mitigations: If upgrading is not immediately possible, disabling the UPnP functionality—especially on any interfaces exposed to the internet—is the primary mitigation to prevent exploitation.

Impact

Access/Capability: Successful exploitation allows an attacker to overwrite stack memory, which can lead to arbitrary code execution, system crashes (Denial of Service), or potential full compromise of the router.
Business Risk: For internet-facing deployments, this vulnerability provides a direct pathway for remote attackers to gain control over network infrastructure. This can facilitate lateral movement within the network, traffic interception, or the permanent impairment of network availability, posing a high risk to both residential and enterprise environments.