Executive Summary
CVE-2021-27137 is a stack-based buffer overflow in DD-WRT’s Universal Plug and Play (UPnP) implementation that allows an unauthenticated attacker with network access to overflow an internal buffer and trigger arbitrary code execution. The CVE was assigned in 2021, but CISA added it to the Known Exploited Vulnerabilities catalog in July 2026 with a federal remediation deadline of July 24 — a five-year gap that reflects continued active exploitation against unpatched DD-WRT deployments in the field.
DD-WRT is third-party open-source firmware widely deployed on consumer and prosumer routers across a large installed base of hardware. Its longevity means many devices running DD-WRT have not been updated in years. The five-year delay between CVE assignment and KEV cataloguing is consistent with router firmware vulnerabilities that see persistent exploitation against unpatched installations long after patches are available.
Affected Versions
DD-WRT builds prior to SVN revision 45724. DD-WRT does not use a traditional version numbering system for its firmware; instead, builds are identified by SVN changeset number and build date. The fix is in SVN changeset 45724 and any build incorporating it.
CISA notes this vulnerability “affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products” — meaning the vulnerable UPnP code may appear in derivative products or vendor firmware based on DD-WRT. Affected parties should check with specific hardware vendors for patching status if running vendor-customised DD-WRT builds.
The vulnerability is rooted in the UPnP daemon component, not in the core routing firmware, which means the exploit path exists regardless of what features or services are otherwise configured on the device.
Vulnerability Details
CWE-121 Stack-Based Buffer Overflow occurs when a program writes data to a buffer allocated on the stack and does not enforce a bound on the amount of data written, allowing the write to overwrite adjacent stack memory.
In the DD-WRT UPnP implementation, the buffer overflow is triggered by processing a crafted UPnP SSDP (Simple Service Discovery Protocol) message or HTTP request to the UPnP daemon’s listening port. The vulnerable code path takes attacker-controlled input (a UPnP device description field, a header value, or an XML body element) and copies it into a fixed-size stack buffer without validating that the input length does not exceed the buffer size.
Overwriting the stack past the buffer boundary corrupts adjacent stack frames. On a function return, the corrupted return address can redirect execution to attacker-controlled code. In practice on embedded Linux systems running DD-WRT, stack protections vary by build configuration and hardware architecture. On builds without stack canaries or non-executable stack enforcement (common on older MIPS-based router hardware), reliable code execution from a stack overflow is achievable.
UPnP is enabled by default on many router firmware builds, including DD-WRT, and the SSDP discovery protocol operates on UDP port 1900 and TCP port 2869. The unauthenticated attack path means no session or credentials are required — an attacker who can reach the UPnP port achieves exploitation directly.
Attack surface consideration: By default, UPnP should only be reachable from the LAN side of a router, not the WAN (internet) interface. However:
- Misconfigurations that expose UPnP to the WAN are common, and mass scanning tools can discover these
- An attacker with any LAN access (compromised device on the same network, WLAN access, or physical access) has a direct exploitation path
- The KEV cataloguing in 2026 suggests exploitation is occurring — likely a combination of LAN-pivoting from compromised devices and WAN-exposed UPnP instances
Exploitation in the Wild
The CISA KEV addition in July 2026 confirms active exploitation against unpatched DD-WRT installations. Historical patterns for router UPnP vulnerabilities suggest the exploitation profile:
Botnet recruitment: Router compromises via network-level vulnerabilities are the most common infrastructure for DDoS botnets. Post-exploitation, attackers install persistent backdoor agents that provide C2 channel access and participate in botnet operations.
Network pivoting: A compromised router is the ideal lateral movement platform — it sits between network segments, can intercept traffic, and may have LAN access to internal services not reachable from the internet.
Credential theft: Routers often cache PPPoE credentials, VPN configurations, and Wi-Fi PSKs in their running configuration. DD-WRT’s configuration includes these in its NVRAM.
Persistent access: Modifying DD-WRT’s configuration to add backdoor accounts, alter DNS settings (DNS hijacking for phishing), or enable remote management (telnet, SSH) from the internet provides persistent access through resets that don’t fully wipe configuration.
The five-year period between CVE assignment (2021) and KEV listing (2026) is not unusual for embedded device vulnerabilities. Unlike server software, router firmware often does not receive automatic updates, and users may not be aware that their DD-WRT build is outdated. The active exploitation in 2026 likely targets the substantial population of devices that have never received an update since initial installation.
Patch and Remediation
Update DD-WRT firmware: Download a build incorporating SVN revision 45724 or later from https://dd-wrt.com. Build dates after the 2021 fix are safe. The DD-WRT download page provides builds organised by router hardware; select the correct build for your device.
Before updating, back up your current DD-WRT configuration via the Administration menu. Firmware updates can reset settings to defaults.
If updating is not immediately possible or the hardware is unsupported:
-
Disable UPnP: In DD-WRT’s administration interface, navigate to NAT/QoS > UPnP and disable the UPnP service entirely. This removes the vulnerable attack surface. Most home and small office networks do not require UPnP for typical operation; disable it unless specific applications require it.
-
Verify WAN exposure: Check whether your DD-WRT instance has UPnP exposed to the WAN interface. Use an external scan (Shodan’s search, or a manual
nmapscan from outside your network) to verify that ports 1900/UDP and 2869/TCP are not reachable from the internet. -
Review connected devices: A router compromise provides persistent access. If you have reason to believe exploitation may have occurred, audit connected clients for unexpected devices and review DD-WRT’s system log for anomalous events.
-
Replace end-of-life hardware: DD-WRT stops releasing new builds for hardware that is no longer supported. If your router hardware is not receiving new DD-WRT builds, consider replacing it with supported hardware and current firmware.
Detection
UPnP traffic anomalies: Monitor traffic to and from UDP 1900 on the LAN network. SSDP messages should originate from LAN clients performing device discovery, not from external sources. Unexpected or malformed SSDP messages warrant investigation.
Router log review: DD-WRT’s system log (Administration > Log) may contain entries related to UPnP daemon crashes or restarts, which can precede or accompany exploitation attempts.
DNS hijacking indicators: A compromised router may redirect DNS queries. Check whether your DD-WRT device is forwarding DNS to unexpected upstream resolvers by reviewing the WAN DHCP/DNS configuration.
Network traffic from router: Traffic from the router’s own IP address to external IPs on unusual ports (especially outbound C2 communications) is a significant indicator of compromise. The router should not be initiating connections to arbitrary external hosts.
Firmware integrity: DD-WRT’s Administration > Firmware page shows the installed build version and date. Verify this against the expected version. Some compromise techniques modify firmware configuration without replacing the firmware image, so log and configuration review is more reliable than firmware version alone.