C0XMO reaches DD-WRT devices by exploiting CVE-2021-27137, a five-year-old unauthenticated stack buffer overflow in the UPnP/SSDP parser. Before installing itself it kills every rival process it finds, deletes their binaries, and removes their cron, init.d, rc.local, and profile entries. The infection starts with an M-SEARCH UDP packet carrying an oversized ST:uuid value on port 1900. A Python scanner built on paramiko then sweeps ports 22, 23, 80, 443, 7547, 8080, 8443, and 8888, fingerprints CPU architecture, and drops the correct binary. The same scanner also carries N-day exploits for CVE-2015-2051 D-Link HNAP, CVE-2022-35914 GLPI, AVTECH DVRs, NVMS-9000, Zyxel devices, and Android ADB. Persistence uses copies in /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys plus a */15 cron entry. Command-and-control relies on hardcoded addresses and a custom handshake. Nineteen DDoS methods are present, among them UDP, SYN, ICMP, NTP amplification, Memcached amplification, Discord voice UDP, and ping of death. Fortinet FortiGuard Labs detailed C0XMO in June, after first observing the Gafgyt variant in March 2026. No public actor attribution. Five-year-old router bugs remain active botnet real estate because the first task of new arrivals is still to evict whoever arrived before them.
Post summary
C0XMO actively exploits the long‑standing CVE‑2021‑27137 stack buffer overflow in DD‑WRT devices, spreading via a Python scanner and establishing persistent malicious processes.