Security readout for executives and security teams
Plain-English summary
CVE-2021-27137 is a DD-WRT UPnP buffer overflow affecting builds before 45724. It matters because vulnerable routers can be compromised without authentication when UPnP is enabled. UPnP is reportedly off by default and limited to internal interfaces by default, which narrows exposure but does not remove risk.
Executive priority
Treat this as urgent for DD-WRT environments because CISA identifies active exploitation. Priority is highest for routers using UPnP or reachable from less trusted networks.
Technical view
The flaw is an unsafe strcpy in router/upnp/src/ssdp.c, in ssdp_msearch, reachable through UPnP M-SEARCH handling. It is classified as CWE-121 with CVSS 3.1 score 8.1. Exploitation requires UPnP to be enabled; the vulnerable path is unauthenticated and network-reachable in that configuration.
Likely exposure
Likely exposure is DD-WRT devices running builds before 45724 with UPnP enabled, especially where internal network compromise or misconfiguration makes UPnP reachable.
Exploitation context
CISA KEV lists this CVE as known exploited. Public reporting also ties it to C0xmo/Gafgyt botnet activity against DD-WRT routers. The bundle does not prove every vulnerable configuration is internet-exposed.
Researcher notes
Sources identify the vulnerable function and fixed DD-WRT changeset but do not provide complete environmental prevalence. Avoid assuming exposure unless UPnP state, build number, and interface reachability are confirmed.
Mitigation direction
- Upgrade DD-WRT to build 45724 or later where supported.
- Disable UPnP if it is not operationally required.
- Restrict UPnP access to trusted internal interfaces only.
- Check current DD-WRT and CISA guidance for any new vendor instructions.
- Monitor routers for unexpected processes, traffic spikes, or configuration changes.
Validation and detection
- Inventory DD-WRT routers and record build numbers.
- Confirm whether UPnP is enabled on each device.
- Verify UPnP is not reachable from untrusted networks.
- Prioritize devices below build 45724 for remediation.
- Review logs and network telemetry for unusual router-originated activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27137 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9mitreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2021-27137 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-07-21T00:00:00.000Z: CVE-2021-27137 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://svn.dd-wrt.com/changeset/45724CVE reference, mitre
- https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/CVE reference, mitre
- https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.htmlCVE reference, mitre
- https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/CVE reference, mitre
- https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmoCVE reference, mitre
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.