CVE-2021-47854

HighPublic PoC

Published: 21 January 2026

Published

21 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0097 57.5th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2021-47854 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2021-47854 is a buffer overflow vulnerability (CWE-120) in the UPNP network discovery service of DD-WRT version 45723. The issue arises when the service processes crafted M-SEARCH packets containing oversized UUID payloads, triggering buffer overflow conditions that allow remote attackers to potentially execute arbitrary code on the target device. This flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impact on confidentiality, integrity, and availability.

Remote, unauthenticated attackers can exploit the vulnerability over the network with low complexity and no user interaction required. By sending specially crafted M-SEARCH packets to a vulnerable DD-WRT router, attackers can overflow the buffer in the UPNP service, potentially achieving arbitrary code execution and full compromise of the device.

Advisories from SSD-Disclosure (https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/) and VulnCheck (https://www.vulncheck.com/advisories/dd-wrt-upnp-buffer-overflow) document the vulnerability in detail. A proof-of-concept exploit is publicly available on Exploit-DB (https://www.exploit-db.com/exploits/49730). DD-WRT users should consult the official site (https://dd-wrt.com/) and beta download repository (https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2021/) for any available patches or updated firmware.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3629

Vulnerability details

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the…

target device.

CWE(s): CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Buffer overflow in publicly exposed UPNP service enables remote unauthenticated arbitrary code execution, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0