DD-WRT UPnP SSDP `uuid` buffer overflow in M-SEARCH handling

CVE-2021-27137 is a buffer overflow in DD-WRT's UPnP/SSDP handling: a crafted M-SEARCH request with an oversized uuid/ST value can smash an internal buffer and potentially lead to code execution on the router. The SSD Secure Disclosure advisory says affected builds are DD-WRT changeset 45723 or earlier, and it explicitly warns that Buffalo devices shipping with DD-WRT should be treated as affected too. DD-WRT fixed it in changeset 45724.

In a vacuum this smells like a router RCE and people will want to slap a 9.8 on it. In the real world, that overstates enterprise risk because the vendor-side writeup says UPnP is disabled by default and listens on internal interfaces, so the usual attacker position is already on the LAN or benefiting from a bad edge exposure decision. That said, FortiGuard reported botnet exploitation on June 3, 2026, so this is not lab-only anymore; that active-use signal pulls it back up to HIGH.

Why this verdict

• Started high on impact: if exploitation lands, the attacker is on the router, which is a privileged network pivot with outsized blast radius compared to an ordinary endpoint bug.
• Downgraded for attacker position: SSD says UPnP is disabled by default and bound to internal interfaces, which usually means the attacker needs internal network reachability or a prior exposure mistake. That is real-world downward pressure because it often implies post-initial-access, not clean internet-first compromise.
• Pulled back up for exploitation evidence: FortiGuard documented botnet use of this CVE on 2026-06-03. That pushes the issue above MEDIUM even though the reachable population is narrower than the raw bug class suggests.

Why not higher?

This is not CRITICAL because the exploit chain is not broadly frictionless across enterprise reality. The combination of default-off service, likely LAN adjacency requirement, and hardware-specific exploit reliability means the reachable population is much smaller than a classic internet-facing server RCE.

Why not lower?

This is not LOW or IGNORE because successful exploitation compromises a router, not a low-value userland process. There is also public technical detail, IDS/IPS coverage, and now exploitation evidence, so treating it as mere backlog hygiene would understate the operational risk for any fleet that still has DD-WRT in scope.

1. Disable UPnP now — If you cannot confirm a fixed build immediately, shut off the vulnerable service path by setting upnp_enable=0 and validating the daemon is no longer listening. Because there is active exploitation evidence, do this immediately, within hours, not on a normal HIGH schedule.
2. Block UDP/1900 to router management planes — Use ACLs/firewall policy to prevent SSDP/UPnP discovery traffic from untrusted segments from ever reaching DD-WRT devices. For exposed, guest, lab, or branch networks, deploy this immediately, within hours as the fastest blast-radius reduction.
3. Hunt for compromised routers — Review network telemetry for malformed or high-volume M-SEARCH traffic, unexpected outbound scans, sudden DNS/NAT changes, hidden payloads under /tmp, and abnormal reboots. Because botnet tradecraft is public, start the hunt immediately, within hours.
4. Replace or reflash stragglers — Move any surviving DD-WRT devices to changeset 45724 or later, or replace them if they are unmanaged or unsupported. With active exploitation evidence, prioritize exposed and branch-edge gear first and begin execution immediately, within hours.

Run this on the DD-WRT device itself over SSH or serial/Telnet as root. Example: scp check_cve_2021_27137.sh [email protected]:/tmp/ && ssh [email protected] 'sh /tmp/check_cve_2021_27137.sh'. It needs root because it reads NVRAM and local process/listener state.

#!/bin/sh
# check_cve_2021_27137.sh
# Purpose: determine whether a DD-WRT device is likely affected by CVE-2021-27137
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

THRESHOLD=45723
TMPFILE="/tmp/cve_2021_27137_check.$$"
trap 'rm -f "$TMPFILE"' EXIT

say() {
  echo "$1"
}

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

# Gather candidate text from common DD-WRT locations.
{
  echo "=== /etc/banner ==="
  [ -r /etc/banner ] && cat /etc/banner
  echo
  echo "=== uname -a ==="
  uname -a 2>/dev/null
  echo
  echo "=== nvram keys ==="
  if have_cmd nvram; then
    nvram get os_version 2>/dev/null
    nvram get os_date 2>/dev/null
    nvram get router_name 2>/dev/null
    nvram get upnp_enable 2>/dev/null | sed 's/^/upnp_enable=/'
    nvram show 2>/dev/null | grep -E '^(os_version|os_date|router_name|upnp_enable)=' 2>/dev/null
  fi
} > "$TMPFILE"

# Basic product sanity check.
if ! grep -qi 'dd-wrt' "$TMPFILE"; then
  say "UNKNOWN: could not positively identify DD-WRT from local banner/NVRAM"
  exit 2
fi

# Extract revision/build numbers from typical strings such as:
#   DD-WRT v3.0-r45723 std
#   SVN revision 45723
REV=$(grep -Eoi 'r[0-9]{5,6}|SVN revision[[:space:]]+[0-9]{5,6}' "$TMPFILE" | head -n 1 | sed -E 's/^r//I; s/^SVN revision[[:space:]]+//I')

if [ -z "$REV" ]; then
  # Fallback: pick a 5-6 digit number near dd-wrt strings if present.
  REV=$(grep -Eoi '[0-9]{5,6}' "$TMPFILE" | head -n 1)
fi

UPNP_STATE="unknown"
if have_cmd nvram; then
  UPNP_RAW=$(nvram get upnp_enable 2>/dev/null)
  case "$UPNP_RAW" in
    1|on|enabled|true|TRUE) UPNP_STATE="enabled" ;;
    0|off|disabled|false|FALSE) UPNP_STATE="disabled" ;;
    *) UPNP_STATE="unknown" ;;
  esac
fi

PROC_STATE="not-seen"
if ps 2>/dev/null | grep -E 'miniupnpd|upnp' | grep -v grep >/dev/null 2>&1; then
  PROC_STATE="running"
fi

LISTEN_STATE="unknown"
if have_cmd netstat; then
  if netstat -anu 2>/dev/null | grep -E '[:.]1900[[:space:]]' >/dev/null 2>&1; then
    LISTEN_STATE="udp1900-listening"
  else
    LISTEN_STATE="no-udp1900-listener-seen"
  fi
fi

if [ -z "$REV" ]; then
  say "UNKNOWN: DD-WRT detected but build/revision could not be parsed"
  say "DETAILS: upnp=$UPNP_STATE process=$PROC_STATE listener=$LISTEN_STATE"
  exit 2
fi

if [ "$REV" -le "$THRESHOLD" ] 2>/dev/null; then
  say "VULNERABLE: DD-WRT revision $REV is <= $THRESHOLD"
  say "DETAILS: upnp=$UPNP_STATE process=$PROC_STATE listener=$LISTEN_STATE fixed-build=45724+"
  exit 1
fi

say "PATCHED: DD-WRT revision $REV is > $THRESHOLD"
say "DETAILS: upnp=$UPNP_STATE process=$PROC_STATE listener=$LISTEN_STATE"
exit 0

Sources

1. SSD Secure Disclosure advisory
2. ONEKEY / IoT Inspector Broadcom SDK research
3. FortiGuard Labs exploitation report
4. SonicWall IPS signature 15489
5. ET/IPFire signature pack evidence
6. NVD later DD-WRT record CVE-2021-47854
7. CISA Known Exploited Vulnerabilities Catalog
8. Seebug mirror preserving vendor response details