CVE-2021-27137
published 2026-07-16CVE-2021-27137: An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote…
PriorityP189high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-07-24
Exploited in the wild
EPSS
16.49%
96.7th percentile
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dd-wrt | dd-wrt | < 45724 | 45724 |
Detection & IOCsextracted from sources · hover to see the quote
port1900/udp
snort
alert udp any any -> $HOME_NET 1900 (msg:"ET EXPLOIT DD-WRT UPNP Unauthenticated Buffer Overflow (CVE-2021-27137)"; content:"M-SEARCH|20|"; startswith; content:"|0d 0a|ST|3a|"; nocase; fast_pattern; content:"uuid|3a|"; within:6; pcre:"/^[^\r\n]{128,}\r\n/R"; reference:url,ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/; reference:cve,2021-27137; classtype:attempted-admin; sid:2032326; rev:2; metadata:attack_target Networking_Equipment, created_at 2021_03_25, cve CVE_2021_27137, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)- →Exploit targets DD-WRT UPnP service on UDP port 1900 via an oversized ST header field in an M-SEARCH request (≥128 chars before CRLF) containing a 'uuid:' value — match the Snort/ET rule pattern: M-SEARCH, ST:, uuid: with pcre for long line.
- →C0XMO establishes persistence via cron jobs relaunching every 15 minutes and modifies shell startup files — hunt for cron entries and shell profile modifications referencing '.sys' hidden binaries. ↗
- →C0XMO uses a custom multi-stage C2 handshake with magic strings and shared secrets — anomalous outbound TCP sessions from IoT/router devices with non-standard handshake patterns should be investigated. ↗
- →Scanner probes common ports 22, 23, 80, 443, 7547, 8080, 8443, 8888 — high-rate outbound scanning to these ports from a router/IoT device is a strong indicator of C0XMO lateral movement activity. ↗
- ·The C2 IP address is described as 'hardcoded' but is not disclosed in the available source material — no specific C2 IP/domain IOC could be extracted. ↗
- ·The Snort rule (ET sid:2032326) targets inbound UPnP traffic to $HOME_NET — ensure UPnP (UDP/1900) is monitored on both perimeter and internal segments as specified in the rule metadata.
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
DD-WRT 24/24 SP2/45723 UPnP router/upnp/src/ssdp.c strcpy buffer overflow (EUVD-2021-34854)
vuldb·2026-07-16·CVSS 8.1
CVE-2021-27137 [HIGH] DD-WRT 24/24 SP2/45723 UPnP router/upnp/src/ssdp.c strcpy buffer overflow (EUVD-2021-34854)
A vulnerability has been found in DD-WRT 24/24 SP2/45723 and classified as very critical. Affected by this vulnerability is the function strcpy of the file router/upnp/src/ssdp.c of the component UPnP Handler. Performing a manipulation results in buffer overflow.
This vulnerability is cataloged as CVE-2021-27137. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.
ghsa_unreviewed·2026-07-16
CVE-2021-27137 [HIGH] CWE-121 An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
VulnCheck
Vulnerability
vulncheck·2021
CVE-2021-27137 Vulnerability
DD-WRT.UPNP.CVE-2021-27137.uuid.Buffer.Overflow
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
CISA
DD-WRT Stack-Based Buffer Overflow Vulnerability
cisa·2026-07-21·CVSS 8.1
CVE-2021-27137 [HIGH] CWE-121 DD-WRT Stack-Based Buffer Overflow Vulnerability
Vulnerability: DD-WRT Stack-Based Buffer Overflow Vulnerability
Affected: DD-WRT DD-WRT
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: Thi
Suricata
ET EXPLOIT DD-WRT UPNP Unauthenticated Buffer Overflow (CVE-2021-27137)
suricata·2021-03-25
CVE-2021-27137 ET EXPLOIT DD-WRT UPNP Unauthenticated Buffer Overflow (CVE-2021-27137)
ET EXPLOIT DD-WRT UPNP Unauthenticated Buffer Overflow (CVE-2021-27137)
Rule: alert udp any any -> $HOME_NET 1900 (msg:"ET EXPLOIT DD-WRT UPNP Unauthenticated Buffer Overflow (CVE-2021-27137)"; content:"M-SEARCH|20|"; startswith; content:"|0d 0a|ST|3a|"; nocase; fast_pattern; content:"uuid|3a|"; within:6; pcre:"/^[^\r\n]{128,}\r\n/R"; reference:url,ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/; reference:cve,2021-27137; classtype:attempted-admin; sid:2032326; rev:2; metadata:attack_target Networking_Equipment, created_at 2021_03_25, cve CVE_2021_27137, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)
No public exploits indexed.
Hackernews
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
blogs_hackernews·2026-07-22·CVSS 7.5
CVE-2026-29059 [HIGH] Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.
The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}").
"The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences," according to an advisory published b
Recorded Future
June 2026 CVE Landscape
blogs_recorded_future·2026-07-10·CVSS 9.1
CVE-2026-35616 [CRITICAL] June 2026 CVE Landscape
## June 2026 CVE Landscape
In June 2026, Insikt Group® identified 60 high-impact vulnerabilities that should be prioritized for remediation , 30 of which had a Very Critical Recorded Future Risk Score. This represents a 49% increase from last month. 23 of the 60 vulnerabilities were included in the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 34 were reported by vendors, and three were primarily surfaced through honeypot data.
The 60 vulnerabilities in this report affected products from 36 vendors, with Microsoft accounting for approximately 18% of the vulnerabilities. The remaining exposure was concentrated across a range of enterprise software, security products, network infrastructure, developer tooling, and cloud platform
Hackernews
⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
blogs_hackernews·2026-06-08·CVSS 8.4
CVE-2025-48595 [HIGH] ⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
Monday again. The weekend was meant to be quiet. It wasn't. Last week had poisoned packages, a broken AI helper, and a worm tearing through repos. The ugly part: basic tricks still worked.
A chatbot got fooled. A bot token got leaked inside the malware. The same old mistakes showed up again. And while everyone chased the loud stuff, quieter attackers sat in inboxes for months, reading mail and stealing it bit by bit.
Lots to cover. Grab coffee. Read up.
## ⚡ Threat of the Week
Miasma Worm Hits 73 Microsoft GitHub Repositories in Supply Chain
Bleepingcomputer
C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
blogs_bleepingcomputer·2026-06-07
CVE-2021-27137 C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
## C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
## Bill Toulas
A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures.
The researchers found samples for ARM, MIPS, PowerPC, SuperH, x86, x86_64, and other architectures, featuring exploits for DVRs, routers, video management platforms, and Android-based devices.
The botnet was seen targeting a Japanese technology company, but researchers discovered that the source IP address was for a device located in Germany.
Fortinet researchers discovered C0XMO and highlighted its modular design, which allows operators to update its exploitation techniques, add/remove targeted architectures, and expand its lateral movement capabilities
https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.htmlhttps://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/https://svn.dd-wrt.com/changeset/45724https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmohttps://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137
2026-07-16
Published
2026-07-21
Added to CISA KEV
Exploited in the wild