DD-WRT UPnP SSDP M-SEARCH stack-based buffer overflow via oversized ST:uuid: value

CVE-2021-27137 is a textbook stack-based buffer overflow in the UPnP SSDP handler (ssdp_msearch) of DD-WRT open-source router firmware, affecting all builds before SVN changeset r45724. An attacker on the same LAN segment — or, if UPnP has been misconfigured to bind the WAN interface, from the internet — can send a crafted M-SEARCH UDP packet to port 1900 with an oversized ST:uuid: value. The strcpy call copies this attacker-controlled string into a 128-byte stack buffer with no bounds check, smashing the stack and delivering arbitrary code execution as root on the router. The vulnerability was originally disclosed around March 2021 and patched the same day in changeset r45724, but the CVE record was not formally published in NVD until July 16, 2026 — a five-year gap that left the flaw in a documentation dead zone. In March 2026, FortiGuard Labs discovered the C0XMO botnet (a Gafgyt variant) weaponizing this exact CVE to recruit DD-WRT routers into a DDoS fleet. CISA added it to the KEV catalog on July 21, 2026 with an aggressive 3-day remediation deadline.

The vendor's HIGH 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is broadly honest for the product class. The AC:H correctly penalizes the fact that UPnP must be explicitly enabled — it ships *off* by default. Where the score slightly oversells the risk to enterprise defenders is the AV:N metric: by default UPnP only listens on *internal* interfaces, meaning the realistic attack vector for most DD-WRT deployments is adjacent-network (AV:A), not full network (AV:N). That single metric swap drops the CVSS to ~7.5. The active C0XMO campaign confirms that real-world exploitation is happening, but the campaign targets SOHO and small-office routers where owners enabled UPnP and never patched — not enterprise-managed infrastructure. For a team managing 10,000 hosts, the immediate question is: *do you even have DD-WRT devices on your network?* If not, this is a documentation exercise. If you do — especially in branch offices or remote-worker home gateways — the KEV listing and active botnet exploitation demand immediate attention.

Sources.

1. CISA KEV Catalog — CVE-2021-27137
2. Rapid7 Vulnerability Database — CVE-2021-27137
3. SecurityAffairs — C0XMO Botnet Competitor-Killing Capability
4. SecurityAffairs — CISA Adds DD-WRT to KEV
5. ManageEngine — C0XMO Threat Reference
6. Tenable — CVE-2021-27137
7. OpenCVE — CVE-2021-27137 Details
8. CIRCL Vulnerability Lookup — CVE-2021-27137

Run this script on the DD-WRT router itself via SSH. Example: ssh [email protected] 'sh -s' < check_cve_2021_27137.sh. Requires root SSH access to the device. The script checks the firmware SVN revision against the fixed changeset and reports UPnP status.

#!/bin/sh
# CVE-2021-27137 Verification — DD-WRT UPnP SSDP Stack Buffer Overflow
# Run ON the DD-WRT router via SSH.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

FIXED_REV=45724

# Confirm this is a DD-WRT device
IS_DDWRT=0
for f in /tmp/loginprompt /etc/motd; do
  [ -f "$f" ] && grep -qi 'dd-wrt' "$f" && IS_DDWRT=1 && break
done
if [ "$IS_DDWRT" -eq 0 ]; then
  nvram get os_version 2>/dev/null | grep -qi 'dd-wrt' && IS_DDWRT=1
fi
if [ "$IS_DDWRT" -eq 0 ]; then
  echo "UNKNOWN - this does not appear to be a DD-WRT device"
  exit 2
fi

# Extract SVN revision number (format: rNNNNN)
REV=""
for src in /tmp/loginprompt /etc/motd; do
  if [ -f "$src" ]; then
    REV=$(sed -n 's/.*r\([0-9][0-9][0-9][0-9][0-9]*\).*/\1/p' "$src" | head -1)
    [ -n "$REV" ] && break
  fi
done
if [ -z "$REV" ]; then
  REV=$(nvram get os_version 2>/dev/null | sed -n 's/.*r\([0-9][0-9][0-9][0-9][0-9]*\).*/\1/p')
fi
if [ -z "$REV" ]; then
  echo "UNKNOWN - could not determine DD-WRT revision number"
  exit 2
fi

# Check UPnP service status
UPNP_NVRAM=$(nvram get upnp_enable 2>/dev/null)
UPNP_PROC=""
pidof upnp >/dev/null 2>&1 && UPNP_PROC="running" || UPNP_PROC="not running"

echo "=== CVE-2021-27137 Check ==="
echo "Device revision:  r${REV}"
echo "Fixed revision:   r${FIXED_REV}"
echo "UPnP nvram:       ${UPNP_NVRAM:-not set} (1=enabled, 0=disabled)"
echo "UPnP process:     ${UPNP_PROC}"
echo "============================"

if [ "$REV" -ge "$FIXED_REV" ] 2>/dev/null; then
  echo "PATCHED - revision r${REV} >= r${FIXED_REV}"
  exit 0
else
  if [ "$UPNP_NVRAM" = "1" ] || [ "$UPNP_PROC" = "running" ]; then
    echo "VULNERABLE - r${REV} < r${FIXED_REV} AND UPnP is ACTIVE"
    exit 1
  elif [ "$UPNP_NVRAM" = "0" ] && [ "$UPNP_PROC" = "not running" ]; then
    echo "VULNERABLE (mitigated) - r${REV} < r${FIXED_REV} but UPnP is disabled"
    exit 1
  else
    echo "VULNERABLE - r${REV} < r${FIXED_REV}, UPnP status inconclusive"
    exit 1
  fi
fi