An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.
Affects DD-WRT builds at change set 45723 or prior with the UPnP service enabled. Fixed in change set 45724.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 45724
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
DD-WRT, an open-source firmware for routers, is affected through its UPnP service, which handles device discovery requests. An unauthenticated attacker who can send a crafted discovery request to a router with UPnP enabled could overflow a fixed-size memory buffer, potentially crashing the device or running arbitrary code.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- DD-WRT DD-WRT
fixed in 45724
References 5
svn.dd-wrt.com
ssd-disclosure.com
bleepingcomputer.com
Questions about CVE-2021-27137
What does this mean?
The UPnP handling code in DD-WRT's SSDP component has a buffer overflow. The flaw can lead to remote code execution on the router.Source: ssd-disclosure.com
Am I affected, and how do I check?
DD-WRT builds at change set 45723 or prior are in scope, but only when the UPnP service is enabled. To check, compare your build's change set against 45724 and confirm whether UPnP is turned on in the router's service settings.Source: ssd-disclosure.com
What should I do about it?
Upgrade DD-WRT to change set 45724 or later, which is the fixed version listed for this issue.Source: ssd-disclosure.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-07-21, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data