CVE-2021-27137
Published: June 3, 2026· Updated: Jul 17, 2026
Official Description
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
Risk Analysis
This vulnerability in DD-WRT UPNP involves a buffer overflow related to UUID processing. While specific severity and CVSS scores are not provided, its inclusion in the KEV catalog indicates confirmed exploitation in the wild, making it a significant threat. This flaw could lead to unpredictable system behavior or arbitrary code execution.
This vulnerability is actively being exploited in the wild. Further details on the exploitation vector are not provided, but the confirmed exploitation status highlights its immediate danger.
Update DD-WRT firmware to a patched version. Disable UPNP if not strictly necessary, and apply general network hardening practices to limit exposure of network devices.
Technical Analysis
CVE-2021-27137 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.
CISA has added CVE-2021-27137 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
News & Research Mentioning CVE-2021-27137
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability CVE-2026-60137 WordPress Core SQL Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-0 [xlite_meta score:67 src:CISA Alerts xlite_fp:524ce280233a6c7753b9d67606f44af5483b28ffc6ac6e16f8dec48bda5d4aa8]
All References (6)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-27137 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1