DD-WRT UPnP overflow exploited (CVE-2021-27137)

Actively exploited in the wild - CVE-2021-27137 is a high-severity buffer overflow in DD-WRT router firmware (before build 45724) that lets an unauthenticated attacker on the local network crash the router or potentially execute code by sending a crafted UPnP M-SEARCH request. If you have UPnP enabled on a DD-WRT device, disable it immediately or update to the latest firmware.

Overview

CVE-2021-27137 is a stack-based buffer overflow in the ssdp.c file of DD-WRT’s UPnP subsystem. The flaw resides in the ssdp_msearch function, which processes incoming UPnP M-SEARCH requests. By sending a specially crafted request that exceeds the length of an internal fixed-size buffer, an attacker can overflow the stack. Although UPnP is disabled by default in DD-WRT and only listens on internal network interfaces when enabled, the vulnerability requires no authentication and no user interaction to trigger. The CVSS 8.1 score reflects the high potential impact despite the network segmentation limit. CISA has confirmed active exploitation of this flaw in the wild, and the current EPSS probability of exploitation is 5.4%.

Impact

A successful attack can cause the UPnP service to crash, resulting in a denial of service for UPnP-dependent features. More critically, attackers may be able to achieve arbitrary code execution on the router, potentially compromising the entire local network. Given that DD-WRT is often deployed as a primary router or wireless access point, an exploited device could allow an attacker to intercept, redirect, or modify network traffic.

Remediation and Mitigation

The vulnerability is patched in DD-WRT build 45724 and later. Users should update their router firmware immediately to the latest stable build via the router’s administrative interface.

If updating is not immediately possible, disable UPnP in the router’s administration panel. This completely eliminates the attack surface because the ssdp_msearch handler is only reachable when UPnP is active. Since UPnP is off by default and the service only listens on internal interfaces, ensuring it remains disabled will protect against external and local exploitation.

Security Insight

This vulnerability is a textbook example of an old vulnerability class — a stack-based buffer overflow in a network-facing service — persisting in modern firmware. That it was discovered in DD-WRT, a popular open-source router firmware, underscores the ongoing challenge of code quality in embedded systems where security audits may lag behind feature development. The addition of this CVE to CISA’s Known Exploited Vulnerabilities catalog reinforces the importance of treating all router firmware updates as critical patches, even when the vulnerable feature is disabled by default. Attackers frequently chain such exploits with social engineering to convince end-users to enable vulnerable services, making proactive hardening and firmware lifecycle management the only reliable defense.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs