CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
Overview
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
Vulnerability details
CVE-2021-27137 is a stack-based buffer overflow (CWE-121) in the SSDP handler within DD-WRT's ssdp.c. The vulnerable code uses an unbounded strcpy to copy the uuid field from an incoming M-SEARCH UDP packet into a fixed 128-byte stack buffer. Because no length check is applied before the copy, an attacker-supplied value that exceeds 128 bytes overwrites adjacent stack memory, including the return address, giving the attacker control over execution flow. The fix in changeset 45724 replaced strcpy with strlcpy bounded by sizeof(name).
An attacker sends a crafted UDP M-SEARCH packet to port 1900 with an oversized value in the ST:uuid field. The SSDP parser in ssdp_msearch copies that value without bounds checking, overflowing the stack buffer and enabling arbitrary code execution with the privileges of the UPnP service process. Two preconditions apply: the DD-WRT administrator must have explicitly enabled UPnP (it is off by default), and the attacker must be able to reach port 1900/UDP, which by default listens only on LAN interfaces. This flaw has been actively exploited by the C0XMO botnet, a Gafgyt variant, to compromise DD-WRT routers and enlist them in DDoS operations.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for UDP traffic to port 1900 originating from hosts outside the expected LAN segment or from sources with no prior DHCP or ARP presence on the local network, which would indicate an attacker with unusual network access reaching the UPnP listener.
- Watch for the UPnP or SSDP daemon process crashing or restarting unexpectedly on DD-WRT devices; a service crash following receipt of an M-SEARCH packet is a direct indicator of exploitation attempts against the ssdp_msearch handler.
- After a suspected compromise, check for files at /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys, and inspect cron jobs and shell profile files (.bashrc, .bash_profile) for unauthorized execution entries, which are persistence indicators associated with C0XMO exploitation of this flaw.
Remediation
Additional hardening
- Upgrade DD-WRT to changeset 45724 or later, which replaces the unbounded strcpy with a length-bounded strlcpy in ssdp.c, eliminating the overflow condition.
- Disable UPnP on all DD-WRT devices where it is not operationally required. Because UPnP is off by default, any device with it enabled represents an explicit configuration choice that should be reviewed and reverted unless justified.
- Apply firewall rules to block inbound UDP traffic on port 1900 at the network perimeter and on any inter-VLAN boundaries, restricting SSDP exposure to only the specific LAN segments where UPnP is needed.
- Audit DD-WRT deployments for signs of prior compromise, including unexpected files in /tmp, /var/tmp, and /dev/shm, unauthorized cron entries, and outbound connections to unknown hosts, given confirmed active exploitation by the C0XMO botnet.
Key dates
References
- https://svn.dd-wrt.com/changeset/45724
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2021-27137
- https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html
- https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/
- https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/
- https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
Frequently asked questions
Does CVE-2021-27137 affect my FedRAMP authorization?
If DD-WRT DD-WRT runs inside your authorization boundary, CVE-2021-27137 is a compliance problem you cannot defer. CISA lists this vulnerability in its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of July 24, 2026. An unpatched KEV inside a FedRAMP authorization boundary is a finding. Your assessor and sponsoring agency will raise it. You remediate it before that deadline or formally document a mitigation. Those are the two options.
How does Knox help me handle CVE-2021-27137?
Knox does not patch DD-WRT DD-WRT on your behalf. Under the FedRAMP shared-responsibility model, that remediation is yours to own. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that remediation, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours. Managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. When something like CVE-2021-27137 surfaces, exposure is identified through continuous monitoring rather than waiting for an assessor to flag it at a periodic review. That earlier signal gives you more time to act before a deadline becomes a finding.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2021-27137 isn't remediated by July 24, 2026?
Missing the July 24, 2026 deadline converts CVE-2021-27137 into a Plan of Action and Milestones (POA&M) item. A single POA&M entry is manageable, but a growing list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Remediating on time keeps your authorization record clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
