CVE-2021-27137

What is DD-WRT?

DD-WRT is a popular open-source Linux-based firmware for consumer and small-business routers, offering advanced networking features (VPN, QoS, VLANs, mesh) that stock vendor firmware typically lacks. It runs on hundreds of router models from manufacturers including Buffalo, Linksys, Netgear, and ASUS, and is widely deployed by hobbyists, small offices, and IoT enthusiasts who reflash stock hardware to get carrier-grade features for free. Because it sits at the network edge and is rarely patched by end users once installed, DD-WRT firmware is a long-running target for botnet operators looking for always-on, internet-facing Linux hosts to recruit.

Overview

CVE-2021-27137 is a stack-based buffer overflow (CWE-121) in DD-WRT's handling of UPnP SSDP requests. The CVE ID was reserved and the bug fixed back in March 2021, but it saw no meaningful attention until March 2026, when FortiGuard Labs identified a new Gafgyt botnet variant — nicknamed C0XMO — actively exploiting unpatched DD-WRT devices as part of a large, multi-CVE, cross-architecture propagation campaign. CISA added the five-year-old CVE to the KEV catalog on July 21, 2026 once sustained in-the-wild exploitation was confirmed, underscoring that an old, low-profile router bug can become urgent the moment a botnet operator decides to weaponize it at scale.

Affected Versions

Any device still running a DD-WRT build from before the March 2021 fix — a common state for routers flashed once and never updated — remains vulnerable. Buffalo devices shipping DD-WRT-derived firmware are also affected.

Technical Details

The flaw sits in DD-WRT's ssdp_msearch handler in ssdp.c, which processes UPnP M-SEARCH discovery requests received over UDP port 1900. The handler copies an attacker-supplied ST:uuid: field into a fixed 128-byte stack buffer without bounds checking; an oversized value overflows the buffer and can redirect execution to attacker-controlled code. The bug requires no authentication and is reachable over the network (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) — but only if the device has UPnP enabled, which is not the default configuration, and reliable exploitation is complicated by ASLR on the target platform, which is reflected in the "High" attack complexity rating.

Discovery

The vulnerability was found and reported by researcher Selim Enes Karaduman, with the advisory published through SSD Secure Disclosure on March 24, 2021. DD-WRT shipped the fix the same day in SVN changeset 45724.

Exploitation Context

FortiGuard Labs' March 2026 research identified C0XMO, a new Gafgyt-family botnet variant, chaining CVE-2021-27137 with more than ten other vulnerabilities — including CVE-2015-2051 (D-Link HNAP), CVE-2022-35914 (GLPI), and CVE-2016-15047/CVE-2025-34054 (AVTECH DVRs) — to compromise devices across ARM, MIPS, PowerPC, SuperH, and x86/AMD64 architectures. The campaign's first observed compromised host was in Japan, with the attacking source IP traced to Germany. No specific threat-actor group has been publicly attributed beyond the Gafgyt/C0XMO malware family, which is consistent with commodity IoT botnet operations rather than a targeted campaign.

Remediation

1. Update DD-WRT firmware to a build that includes SVN changeset 45724 or later — check your specific router model's DD-WRT firmware page for the current release.
2. Disable UPnP on the router's WAN-facing interface if it is not required; this closes the exploitation path entirely regardless of patch status, since the flaw only triggers when UPnP is enabled.
3. Block UDP port 1900 (SSDP) from the WAN side at the router or upstream firewall if UPnP must remain enabled for LAN devices.
4. Check for signs of botnet recruitment: unexpected outbound connections, unfamiliar cron/init entries, or high CPU usage consistent with DDoS participation, particularly on devices that have never been updated since initial flashing.
5. Treat any internet-facing DD-WRT device running pre-2021 firmware as compromised given confirmed active mass-exploitation, and reflash from a clean, current firmware image rather than attempting in-place remediation.