CVE-2021-27137: DD-WRT — UPnP Stack Buffer Overflow RCE

Background

DD-WRT is third-party open-source firmware widely deployed on consumer and prosumer routers across a large installed base of hardware. Unlike vendor firmware that arrives pre-installed and receives automatic updates, DD-WRT requires users to actively download and apply builds from the project’s SVN build system. Its longevity means many devices running DD-WRT have not been updated in years — some installations date to initial setup and have never received a firmware update since.

CVE-2021-27137 is a stack-based buffer overflow in DD-WRT’s Universal Plug and Play (UPnP) implementation. An unauthenticated attacker with network access to the router’s UPnP service can overflow a fixed-size stack buffer and achieve arbitrary code execution. The CVE was assigned in 2021; CISA added it to the Known Exploited Vulnerabilities catalogue in July 2026 — a five-year gap that reflects the persistent exploitation pattern common to embedded device vulnerabilities against large populations of unpatched hardware.

Technical Mechanism

CWE-121 Stack-Based Buffer Overflow occurs when a program writes data to a buffer allocated on the stack without enforcing a size bound, allowing the write to overwrite adjacent stack memory.

The vulnerable code path in DD-WRT’s UPnP daemon processes incoming UPnP SSDP (Simple Service Discovery Protocol) messages or HTTP requests arriving on the UPnP service’s listening ports. The code takes attacker-controlled input — a device description field, header value, or XML body element — and copies it into a fixed-size stack buffer without validating that the input length does not exceed the buffer’s capacity.

The overflow writes past the buffer boundary into adjacent stack frames. When the vulnerable function returns, the corrupted return address redirects execution to attacker-controlled code. On older MIPS-based router hardware running DD-WRT builds without stack canaries or non-executable stack enforcement — common configurations for this platform — reliable code execution from a stack overflow is achievable.

Attack surface details:

UPnP is enabled by default on many DD-WRT builds. The SSDP discovery protocol listens on UDP port 1900 and TCP port 2869. No credentials are required before the vulnerable code path is reached — exploitation is pre-authentication.

By default, UPnP should only be reachable from the LAN side of the router, not the WAN (internet) interface. However, WAN-exposed UPnP instances are discoverable via Shodan and mass scanning tools. LAN-side exploitation requires any compromised device on the same network — a single infected client is sufficient to reach the router’s UPnP service.

CISA notes the vulnerability “affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products,” meaning the vulnerable UPnP code may appear in derivative products or vendor firmware based on DD-WRT.

Real-World Exploitation Evidence

CISA added CVE-2021-27137 to the Known Exploited Vulnerabilities catalogue in July 2026 with a federal remediation deadline of July 24. The addition confirms active exploitation against unpatched DD-WRT installations in the field.

The five-year period between CVE assignment (2021) and KEV listing (2026) is consistent with the exploitation lifecycle of embedded device vulnerabilities. Unlike server software, router firmware typically does not receive automatic updates. Users may be unaware their DD-WRT build is outdated, and many devices remain in service long after their hardware stops receiving DD-WRT build support.

Historical exploitation patterns for UPnP router vulnerabilities are well-established:

• Botnet recruitment: Compromised routers are the most common infrastructure for DDoS botnets. Post-exploitation, attackers install persistent backdoor agents providing C2 channel access and botnet participation
• Network pivoting: A compromised router sits between network segments and can intercept traffic, providing LAN access to internal services not reachable from the internet
• Credential theft: Routers often cache PPPoE credentials, VPN configurations, and Wi-Fi PSKs in NVRAM accessible after full compromise
• Persistent access: Modifying DD-WRT configuration to add backdoor accounts, alter DNS settings, or enable remote management from the internet provides persistence that survives configuration resets that do not fully wipe NVRAM

Impact Assessment

Complete router compromise provides an attacker with:

• Network position: Full visibility into all traffic passing through the router; ability to intercept, modify, or drop traffic between LAN hosts and the internet
• DNS control: Modifying upstream DNS resolvers enables DNS hijacking for phishing, credential theft, and certificate pinning bypass
• LAN access: An attacker controlling the gateway can reach all hosts on the LAN, including those with no internet exposure
• Botnet node: The compromised router becomes a botnet participant, contributing bandwidth to DDoS operations and serving as a persistent C2 channel
• Credential harvesting: PPPoE account credentials, VPN configurations, and network-wide Wi-Fi PSKs stored in NVRAM are accessible

For homes and small businesses where the router is the only network security device, router compromise effectively eliminates the boundary between the internal network and attacker-controlled infrastructure.

Affected Versions

DD-WRT does not use traditional version numbering; builds are identified by SVN changeset number and build date.

DD-WRT stops releasing builds for hardware that is no longer supported by the project. Devices running end-of-support DD-WRT that cannot receive new builds incorporating the fix have no vendor patch path and require hardware replacement or isolation.

Remediation Steps

1. Update DD-WRT firmware to a build incorporating SVN revision 45724 or later from https://dd-wrt.com. Build dates after the 2021 fix are safe. The DD-WRT download page organises builds by router hardware — select the correct build for your device model.

2. Back up configuration before updating. Firmware updates can reset settings to defaults. Back up via Administration > Backup.

3. If updating is not immediately possible, disable UPnP: navigate to NAT/QoS > UPnP in the DD-WRT administration interface and disable the UPnP service. This removes the vulnerable attack surface. Most home and small office networks do not require UPnP for typical operation.

4. Verify WAN exposure. Confirm that ports 1900/UDP and 2869/TCP are not reachable from the internet. Use an external scan from a tool like Shodan (search your IP range) or a manual nmap scan from outside your network.

5. Replace end-of-life hardware. If your router is no longer receiving DD-WRT builds, consider replacing it with hardware that receives current firmware and security updates.

6. Review connected devices for unexpected or unfamiliar hosts if exploitation may have occurred. Audit DD-WRT’s system log for anomalous events.

Detection Guidance

UPnP traffic anomalies: Monitor traffic to and from UDP 1900 on the LAN network. SSDP messages should originate from LAN clients performing device discovery, not from external sources. Malformed or oversized SSDP messages warrant investigation.

Router log review: DD-WRT’s system log (Administration > Log) may contain entries related to UPnP daemon crashes or restarts, which can precede or accompany exploitation attempts. Repeated daemon restarts suggest active exploitation activity.

DNS hijacking indicators: A compromised router may redirect DNS queries to attacker-controlled resolvers. Verify that your DD-WRT device is forwarding DNS to expected upstream resolvers under Setup > Basic Setup > DNS.

Network traffic from router: Traffic originating from the router’s own management IP to external IPs on unusual ports is a significant indicator of compromise. Routers should not initiate connections to arbitrary external hosts.

Firmware integrity: DD-WRT’s Administration > Firmware page shows the installed build version and date. Verify this against the expected version. Note that some compromise techniques modify configuration without replacing the firmware image, so log and configuration review is more reliable than firmware version alone.

Timeline

References

• DD-WRT SVN Changeset 45724
• NVD — CVE-2021-27137
• CISA KEV Catalog
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk