Loading vulnerability…
DD-WRT UPnP Stack-Based Buffer Overflow
CVE-2021-27137 is a stack-based buffer overflow in DD-WRT builds before 45724. The UPnP SSDP M-SEARCH handling path, specifically ssdp_msearch, uses an unsafe strcpy operation to copy attacker-controlled request data into an internal fixed-size buffer. An unauthenticated remote attacker can send a specially crafted SSDP M-SEARCH request to overflow the buffer when UPnP is enabled.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt process memory, causing denial of service and potentially enabling arbitrary code execution with the privileges of the vulnerable DD-WRT UPnP service. Active exploitation has been observed for malware deployment and enrollment of affected routers into botnets.
If you can’t patch tonight, do this now.
Disable UPnP where it is not operationally required. Until patching is complete, restrict SSDP/UPnP M-SEARCH traffic to trusted internal networks, prevent exposure of the UPnP service to untrusted networks, and monitor for anomalous SSDP M-SEARCH activity and unexpected router process behavior.
Patch, then assume compromise.
Upgrade DD-WRT to build 45724 or later, which replaces the vulnerable behavior. Verify that deployed router firmware incorporates the fix and replace devices that cannot be upgraded to a fixed build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.