{"id":"CVE-2021-27137","kind":"vulnerability","aliases":["CVE-2021-27137"],"related":[],"title":"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724","description":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"DD-WRT router firmware has a stack-based buffer overflow in its UPnP service. An unauthenticated attacker on the network can overflow the buffer and run code on the router.","severity":"high","cvss":8.1,"epss":null,"exploited":true,"exploited_at":"2026-07-21T00:00:00+00:00","products":[{"name":"DD-WRT DD-WRT","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dd-wrt","fixed":["45724"],"affected":"< 45724","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dd-wrt","exploited","infrastructure","routers","self-hosted"],"not_affected_if":["no-dd-wrt-firmware","upnp-disabled"],"how_to_check":null,"fix":"Move to a DD-WRT build that fixes the UPnP overflow, or disable UPnP on the router and restrict the router's LAN and WAN exposure. The sources do not name the fixed version.","status":"open","published_at":"2026-07-16T18:16:39+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:33+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:33:33Z","model":"claude-haiku-5-5","output":{"fix":"Move to a DD-WRT build that fixes the UPnP overflow, or disable UPnP on the router and restrict the router's LAN and WAN exposure. The sources do not name the fixed version.","summary":"DD-WRT router firmware has a stack-based buffer overflow in its UPnP service. An unauthenticated attacker on the network can overflow the buffer and run code on the router.","category":"infrastructure","who_cares":["dd-wrt","routers","self-hosted"],"confidence":0.7,"analyst_note":"Find the fixed DD-WRT build and the exact UPnP check. The KEV entry lists no affected versions; see the DD-WRT advisory for CVE-2021-27137 and the CISA KEV page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["upnp-disabled","no-dd-wrt-firmware"],"severity_if_unknown":"high"},"cost_usd":0.000381,"input_tokens":2219,"output_tokens":319,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':117C,143C,174C '-2021':14A,17A '-27137':15A,18A '26':116C,142C,173C '45724':12A 'accord':106C 'action':102C 'adher':170C 'allow':82C 'appli':103C 'applic':140C 'asset':164C 'attack':55B,85C 'base':46B,76C,121C 'bod':115C,141C,172C 'buffer':47B,62B,77C,90C 'cisa':100C,113C,130C 'cloud':146C 'code':65B,97C 'complianc':111C 'contain':72C 'could':81C 'cve':13A,16A 'dd':9A,20A,23A,26A,29B,38B,70C 'dd-wrt':8A,19A,22A,25A,28B,37B,69C 'discontinu':149C 'discov':4A 'ensur':110C,169C 'evalu':162C 'execut':98C 'exploit':31B 'exposur':167C 'firmwar':41B 'follow':139C 'forens':132C 'guidanc':128C,144C 'guidelin':176C 'host':36B 'infrastructur':32B 'instruct':109C 'intern':89C 'internet':166C 'issu':2A 'mitig':104C,155C 'network':58B 'note':127C,138C 'overflow':48B,60B,78C,87C 'patch':175C 'priorit':118C 'product':153C 'requir':101C,134C 'respons':160C 'risk':123C 'router':33B,40B,68B 'router/upnp/src/ssdp.c':6A 'run':64B 'secur':119C 'see':124C,135C 'self':35B 'self-host':34B 'servic':52B,147C 'stack':45B,75C 'stack-bas':44B,74C 'stakehold':158C 'triag':133C 'trigger':95C 'unauthent':54B,84C 'unavail':157C 'updat':120C 'upnp':51B,93C 'url':125C,136C 'use':91C,150C 'vendor':108C 'vulner':79C,99C 'wrt':10A,21A,24A,27A,30B,39B,71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-16T18:16:39+00:00","kev":{"dateAdded":"2026-07-21","dueDate":"2026-07-24","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-27137","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137","severity":null,"published_at":"2026-07-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-27137","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27137","severity":null,"published_at":"2026-07-16T18:16:39+00:00","modified_at":"2026-07-22T05:17:07+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}