HIGH

CVE-2021-27137

Dd-wrt Dd Wrt 2026-07-16 CVSS v3.1

CVSS

8.1

KEV

Description

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

Summary dbcve.org

Buffer overflow vulnerability in DD-WRT's UPnP SSDP handling (router/upnp/src/ssdp.c). An unsafe strcpy in the ssdp_msearch function allows an unauthenticated remote attacker to overflow a fixed-size buffer via a specially crafted M-SEARCH SSDP request. Exploitation requires UPnP to be enabled, which is off by default and restricted to internal interfaces.

Mitigation

Upgrade DD-WRT to version 45724 or later. If UPnP is not required, leave it disabled. Ensure UPnP is only exposed to trusted internal networks.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-121 Stack-based Buffer Overflow

EPSS Score

Probability of exploitation in next 30 days

90.1th percentile

References

https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html Exploit, Third Party Advisory https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/ Exploit, Third Party Advisory https://svn.dd-wrt.com/changeset/45724 Patch https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/ Exploit, Third Party Advisory https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo Exploit https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE