noindex and left out of the sitemap until more data is confirmed.CVE-2021-27137 is a stack-based buffer overflow in DD-WRT's UPnP SSDP handling (ssdp_msearch) that lets an unauthenticated attacker overflow an internal buffer via a crafted M-SEARCH request and potentially execute code, but only if the router's UPnP service — disabled by default — has been turned on; it is on CISA's KEV catalog tied to botnet activity, but NVD's own vulnerability-status field is "Analyzed" without an NVD-published Primary score, only a CVE-numbering-authority-submitted score, so per our indexing policy this page stays pending with no NVD-confirmed cvss_score.
Vulnerability summary
N/A
Not yet scored
4.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-07-16
Published
Vulnerability ID: CVE-2021-27137 · Source: NVD (MITRE CNA Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| DD-WRT (open-source router firmware) | cpe:2.3:o:dd-wrt:dd-wrt:*:*:*:*:*:*:*:* | before SVN changeset 45724 (fixed in changeset 45724); includes third-party devices such as some Buffalo routers shipping DD-WRT |
What this means
CVE-2021-27137 is a stack-based buffer overflow (CWE-121) in DD-WRT, a widely used open-source Linux-based router firmware that ships on, or is flashed onto, routers from many vendors. NVD's description states: "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request)" (NVD).
NVD's vulnStatus for this record is Analyzed (published to NVD on 2026-07-16, years after the original 2021 CVE reservation), but NVD has not published its own independent Primary CVSS score; the only metric on record is a CNA-attributed Secondary rating of CVSS v3.1 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD). So the 8.1 figure is a Secondary score, not an NVD-confirmed Primary score, and is not used as this page's cvss_score.
The original SSD Secure Disclosure advisory describes the bug as an unvalidated copy in the SSDP implementation: a crafted UPnP discovery packet with an overly long uuid value overflows a 128-byte internal buffer, and the public proof-of-concept overwrites a return address using 164 bytes of padding, demonstrating code-execution potential rather than just a crash. It confirms "by default, UPNP in DD-WRT is disabled" and only listens on internal interfaces by default — but once an administrator turns UPnP on, any device able to reach it on the LAN (and in some router configurations, further afield) can send the unauthenticated M-SEARCH request, since "UPnP in its nature is an unauthenticated protocol." The DD-WRT project shipped a fix at SVN changeset 45724 shortly after notification (SSD Advisory — DD-WRT UPnP Buffer Overflow; DD-WRT changeset 45724).
CISA added CVE-2021-27137 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-21 (catalog version 2026.10.28, 1762 entries, confirmed live this run), with a required-action due date of 2026-07-24 and forensic-triage flagged "Yes" under BOD 26-04; the KEV notes direct affected organizations to "check with specific vendors for information on patching status" since DD-WRT is embedded in many third-party router products. Separately, Fortinet's threat research on the "C0xmo" Gafgyt-family botnet variant documents this DD-WRT UPnP flaw as one of the router vulnerabilities the botnet uses to spread and to kill competing malware on infected devices (CISA KEV; Fortinet — C0xmo cross-platform propagation).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.03995 (90.48th percentile) — elevated for an old, UPnP-gated flaw, consistent with ongoing IoT-botnet scanning of routers that have UPnP exposed (FIRST EPSS).
Until NVD completes its own scoring, treat the 8.1 figure as indicative only, not NVD-confirmed. Any DD-WRT device before SVN changeset 45724 should be updated, and administrators should disable UPnP (the DD-WRT default) unless it is specifically required, regardless of patch status.
Evidence
- An unsafe strcpy in DD-WRT's UPnP SSDP handling (ssdp_msearch) lets an unauthenticated attacker overflow a fixed internal buffer via a crafted M-SEARCH request, but only if UPnP (off by default) has been enabled. — NVD
- CVSS v3.1 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — a CNA Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
- A crafted UPnP discovery packet with an overly long uuid value overflows a 128-byte buffer; PoC demonstrates return-address overwrite; UPnP is off by default and only listens internally; fixed at DD-WRT SVN changeset 45724. — SSD Advisory — DD-WRT UPnP Buffer Overflow
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-21, required-action due date 2026-07-24, forensic-triage required under BOD 26-04 (catalog version 2026.10.28, 1762 entries, confirmed live this run); exploited by the Gafgyt-family "C0xmo" IoT botnet to spread between routers. — CISA KEV / Fortinet C0xmo threat research
- EPSS score is 0.03995 (90.48th percentile) as of 2026-10-28. — FIRST EPSS
