Cyber Resilience

CVE-2021-27137

Memory Safety in Dd-Wrt ≤ 45724

CISA KEVActive ExploitationPublic PoCMemory Safety
Published
16 July 2026
Modified
22 July 2026
KEV Added
21 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.16 97th percentile
Risk Priority 81 floored blend · peak EPSS

Summary

CVE-2021-27137 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dd-Wrt Dd-Wrt. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to…

more

enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

CWE(s)
CWE-121
KEV Date Added
21 July 2026

Related Threats

Threat-Actor AttributionAI

C0xmoaka Gafgyt
C0xmo (Gafgyt variant) IoT botnet publicly reported exploiting CVE-2021-27137 in DD-WRT UPnP to spread and kill rival malware (BleepingComputer, Fortinet, SecurityAffairs).

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Buffer overflow in UPnP/SSDP service allows unauthenticated remote RCE via crafted M-SEARCH, directly enabling exploitation of network-exposed services (T1190) or remote services (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1210 Exploitation of Remote Services Lateral Movementconfidence: HIGH
Buffer overflow in UPnP/SSDP service allows unauthenticated remote code execution via crafted M-SEARCH request.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-20352Shared CWE-121both on KEV
CVE-2025-53521Shared CWE-121both on KEV
CVE-2025-60569Shared CWE-121
CVE-2024-34201Shared CWE-121
CVE-2025-65220Shared CWE-121
CVE-2025-66176Shared CWE-121
CVE-2024-2809Shared CWE-121
CVE-2025-0282Shared CWE-121both on KEV
CVE-2024-34207Shared CWE-121
CVE-2025-60679Shared CWE-121

Affected Assets

dd-wrt
dd-wrt
≤ 45724

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • CM-7 Least Functionality
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces input validation on M-SEARCH requests to block the unsafe strcpy that overflows the fixed buffer in ssdp.c.

CM-7 Least Functionality good match
prevent

Disables or restricts the UPnP service (off by default) so the vulnerable ssdp_msearch code path is never reachable.

SI-2 Flaw Remediation good match
prevent

Requires prompt application of the DD-WRT >=45724 patch that replaces the unsafe strcpy in UPnP handling.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent introduction of stack buffer overflows.

ID.RA-01 partial match
prevents

Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.

PR.PS-02 partial match
prevents

Patching eliminates known instances of the weakness after discovery.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing (fuzzing, static analysis) detects stack overflows before release.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates buffer-safety practices that directly prevent stack overflows.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify buffer-size and input-validation rules.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include memory-safety and least-privilege stack usage.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid unsafe buffer handling that causes CWE-121.

A.8.32 Change management none match
none

Change-management gates can enforce security reviews that catch buffer issues.

References