CVE-2021-27137Active Exploitation(dd-wrt / dd-wrt)

HIGHCVSS 8.1 · HIGHCISA KEV

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

Patch dd-wrt dd-wrt systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

dd-wrt CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-24. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

https://svn.dd-wrt.com/changeset/45724

Exploit / PoC references

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137

Weakness type (CWE)

CWE-121

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dd-wrt

Threat summary

Active exploitation appears in 19 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
25 mentions across 12 observed days

What's happening

Active exploitation reported across 19 signals
Exploit tool or code specified in 3 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 5 signals
Technical details provided in 15 signals
Disclosure: 5 classified signals
Peaked 4d ago at 5 mentions (2026-07-21); latest day: 1
25 total mentions across 12 days

Affected systems

Vendors

dd-wrt

Products

dd-wrt

Deep dive

Activity timeline25 mentions / 12d

Signal classification5 categories

Active Exploitation

1768.0%

Disclosure

520.0%

Exploit

14.0%

Patch

14.0%

General

14.0%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	1	Active Exploitation1
2026-06-04	2	Active Exploitation1Exploit1
2026-06-05	2	Active Exploitation2
2026-06-06	1	Disclosure1
2026-06-07	4	Active Exploitation4
2026-06-08	3	Active Exploitation3
2026-06-09	2	Active Exploitation2
2026-07-21	5	Active Exploitation3Disclosure1Patch1
2026-07-23	1	General1
2026-07-24	2	Disclosure2
2026-07-28	1	Disclosure1
2026-08-03	1	Active Exploitation1

Full discourse20 posts

Virus Bulletin@virusbtn136d
Exploit
Vincent Li at FortiGuard Labs analyses new Gafgyt variant C0XMO, which spreads by exploiting CVE-2021-27137. A key change is the separation of lateral movement into a standalone Python script, helping the botnet target multiple architectures & device types https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo https://t.co/0ZECSf3p36
Post summary
Analysis of a new Gafgyt variant that exploits CVE-2021-27137, with a standalone Python lateral‑movement script, but no evidence of active exploitation, patches, or debunking claims.
0801444.8K
61.4K followersView on X
Cyber_OSINT@Cyber_O51NT132d
Active Exploitation
C0XMO, a new Gafgyt variant, spreads via CVE-2021-27137 to various IoT devices, eliminates rival botnets and persistence mechanisms, and enables large-scale DDoS with a modular, Python-based scanner. https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html
Post summary
The new C0XMO botnet variant leverages CVE‑2021‑27137 to infect IoT devices and orchestrate large‑scale DDoS attacks, demonstrating active exploitation of the vulnerability, but the text offers no PoC, patch, or detailed technical info.
0401031.2K
22.6K followersView on X
DFIR Radar@DFIR_Radar137d
Active Exploitation
New Gafgyt variant C0XMO exploits DD-WRT routers via CVE-2021-27137, features modular Python-based lateral movement and targets multiple Linux architectures. Advanced botnet shows operational evolution. Technical breakdown: • Exploits stack buffer overflow in DD-WRT UPnP service via malformed SSDP M-SEARCH requests on UDP 1900 • Multi-stage persistence: copies to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys with cron jobs every 15 minutes • Separates scanning into standalone Python script using paramiko, requests, beautifulsoup4 packages • C2 handshake uses magic string 669787761736865726500 + shared secret to 85[.]215[.]131[.]70 • Supports 19 DDoS attack methods including UDP bypass, TCP floods, NTP amplification, Cloudflare bypass Attack chain: • Initial access via CVE-2021-27137 buffer overflow targeting Japanese 🇯🇵 tech firm from Germany 🇩🇪 • Downloads architecture-specific binaries (ARM, MIPS, x86_64, PowerPC) to /tmp/.cache • Python scanner targets Telnet/SSH weak credentials + HTTP exploits (GLPI, AVTECH, Zyxel) • Terminates competing botnets and removes rival persistence mechanisms Hunt for hidden executables in /tmp/.sys, /var/tmp/.sys with 755 permissions and outbound connections to 85[.]215[.]131[.]70 or 217[.]160[.]125[.]125:15527. #DFIR_Radar
Post summary
The post details a real‑world exploitation of CVE-2021-27137 in DD‑WRT routers, outlining specific attack vectors and operational mechanisms.
11140601
1.8K followersView on X
FortiGuard Labs@FortiGuardLabs131d
Active Exploitation
🚨 Our latest research uncovers #C0XMO, a sophisticated Gafgyt botnet variant exploiting CVE-2021-27137 in DD-WRT routers. Unlike previous versions, C0XMO uses a standalone Python script for lateral movement, enabling cross-platform propagation across multiple Linux architectures and device types. Read our full analysis for insights: https://ow.ly/TYjq50Z8eSO 👈
Post summary
Researchers discovered a new Gafgyt botnet variant, C0XMO, that actively exploits CVE‑2021‑27137 on DD‑WRT routers and adds lateral movement via a Python script.
03020359
40.7K followersView on X
DFIR Radar@DFIR_Radar133d
Active Exploitation
C0XMO botnet variant exploits CVE-2021-27137 in DD-WRT routers, supports 7+ CPU architectures and 19 DDoS methods. Actively kills competing malware and red-team tools before establishing persistence. #DFIR_Radar https://t.co/nTXqybVPvf
Post summary
The tweet reports that the C0XMO botnet variant actively exploits CVE-2021-27137 in DD‑WRT routers, showcasing its persistence and anti‑malware capabilities, but provides no PoC, exploit code, or patch information.
10031439
1.8K followersView on X
Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir86d
Disclosure
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik #GüvenlikBülteni 🎯 Zafiyet Bilgisi Ürün: DD-WRT Zafiyet: Yığın Tabanlı Buffer Taşması (Stack-Based Buffer Overflow) CVE: CVE-2021-27137 Zafiyet Türü: Stack-Based Buffer Overflow (CWE-121) Fidye Yazılımı İlişkisi: Şu an için bilinmiyor. 📌 Zafiyet Özeti DD-WRT üzerinde, Yığın Tabanlı Buffer Taşması (Stack-Based Buffer Overflow) zafiyeti tespit edilmiştir. Bu güvenlik açığı, kimlik doğrulaması gerektirmeyen bir saldırganın UPnP bileşenini hedef alan özel hazırlanmış istekler aracılığıyla dahili buffer'ın taşmasına neden olarak Uzaktan Kod Çalıştırma (Remote Code Execution - RCE) gerçekleştirmesine olanak tanıyabilir. Başarılı bir istismar sonucunda saldırgan, etkilenen yönlendirici üzerinde yetkisiz kod çalıştırabilir, cihazın kontrolünü ele geçirebilir, ağ trafiğini manipüle edebilir ve kurumsal veya ev ağını daha kapsamlı saldırılar için kullanabilir. 🛡️ Önerilen Aksiyonlar ✅ Güvenlik Güncellemeleri DD-WRT geliştiricileri tarafından yayımlanan güvenlik güncellemelerini en kısa sürede uygulayın. Cihaz üreticiniz tarafından sağlanan güncel firmware sürümlerini kontrol ederek yükleyin. ✅ Risk Yönetimi Süreçlerinizi CISA'nın BOD 26-04 (Risk Tabanlı Güvenlik Güncellemelerinin Önceliklendirilmesi) ve Forensics Triage Requirements rehberlerine uygun şekilde yönetin. ✅ Erişim Kontrolleri Gerekmiyorsa UPnP özelliğini devre dışı bırakın. Yönetim arayüzünü yalnızca güvenilir ağlardan erişilebilir hale getirin. Gereksiz port yönlendirmelerini kaldırın ve internete açık yönetim erişimini kapatın. ✅ Geçici Koruma Önlemleri Güvenlik güncellemesi henüz uygulanamıyorsa, cihazı internetten izole edin veya yalnızca VPN üzerinden yönetilebilir hale getirin. Ayrıca UPnP servisini devre dışı bırakarak saldırı yüzeyini azaltın. 📚 Referans: DD-WRT Security Advisory & CISA
Post summary
The bulletin discloses a stack‑based buffer overflow (CVE‑2021‑27137) in DD‑WRT that enables remote code execution and recommends applying security updates and disabling UPnP to mitigate the risk.
0202028
525 followersView on X
Elusive@ElusivePrivacy132d
Active Exploitation
C0XMO Botnet New Gafgyt variant spreads via a 5-year-old DD-WRT router flaw, then kills rival malware to monopolize the device. C0XMO exploits CVE-2021-27137 a stack buffer overflow in the UPnP service for unauthenticated access. Cross-platform, moving between architectures. FortiGuard Labs discovered it. Source: BleepingComputer / FortiGuard Labs Follow @VulnerabilityNw
Post summary
C0XMO botnet is actively exploiting CVE-2021‑27137, a stack buffer overflow in UPnP, with evidence of cross‑platform usage, but no PoC or patch details are provided.
0101063
183 followersView on X
CyberX@CyberXlx9q133d
Active Exploitation
‼️A new botnet variant dubbed C0XMO is actively exploiting a known DD-WRT router vulnerability (CVE-2021-27137) to compromise internet-facing devices and build a powerful DDoS network. What makes it stand out? The malware not only infects routers and IoT devices across multiple CPU architectures but also terminates competing malware to maintain exclusive control of infected systems. A reminder that unpatched edge devices remain a prime target for botnet operators. #CyberSecurity #Botnet #IoT #DDoS #ThreatIntel
Post summary
The post highlights a new botnet variant (C0XMO) that is actively exploiting the DD‑WRT router vulnerability CVE‑2021‑27137 to compromise devices and build a large DDoS network, underscoring the risk to unpatched edge devices.
0001198
121 followersView on X
CyberAlertsHQ@CyberAlertsHQ133d
Active Exploitation
🚨 NEW: C0xmo — a new Gafgyt botnet variant — is spreading through a DD-WRT router flaw (CVE-2021-27137) with no credentials needed. Once in, it kills rival botnets, wipes their persistence, and takes sole ownership of the device. It supports 19 DDoS methods and goes cross-platform — targeting Linux servers, IoT devices, and exposed Android devices via ADB. What sets it apart: a standalone Python scanner that auto-detects device architecture and drops the right payload for each target. DD-WRT is deployed across millions of home offices and small businesses. Update your router firmware now or disable UPnP on port 1900 immediately. Full breakdown 👇 https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/
Post summary
The tweet reports that CVE-2021-27137 is actively exploited by the C0xmo botnet via a DD‑WRT router flaw, provides mitigation steps, and offers technical details about the attack.
1001067
77 followersView on X
SecPod@SecPod132d
Active Exploitation
The C0XMO Gafgyt variant is exploiting CVE-2021-27137 in DD-WRT routers, spreading across Linux architectures, and enabling DDoS attacks. Prevent potential exposure from this vulnerability with the Saner Platform. #CyberSecurity #CVE #IoTSecurity #Botnet #VulnerabilityManagement
Post summary
C0XMO Gafgyt is actively exploiting CVE-2021-27137 in DD‑WRT routers, spreading across Linux systems to launch DDoS attacks, but no PoC, exploit code, patch, or technical details are provided.
0001070
543 followersView on X
Cybersecurity News Everyday@TweetThreatNews133d
Active Exploitation
C0XMO, a modular Gafgyt botnet, targets DD-WRT routers via CVE-2021-27137, brute-forces weak SSH/Telnet logins, and kills rival malware while spreading across many device architectures. #C0XMO #Gafgyt #DDWRT https://ift.tt/T6z9bNP
Post summary
The post reports that the C0XMO botnet actively exploits CVE‑2021‑27137 against DD‑WRT routers by brute‑forcing weak SSH/Telnet credentials to spread across devices.
00010286
4.4K followersView on X
protect_cyber_sec@AmirHossein_sec134d
Disclosure
نسخه جدید بات نت C0XMO برای سیستم های لینوکسی منتشر شد. این بدافزار ابتدا اقدام به اسکن پورت ssh می نموده ، سپس از طریق Bruteforce پسورد این سرویس ، وارد سیستم می شود. همچنین از آسیب پذیری با کد شناسایی CVE-2021-27137 که از نوع Buffer overflow می باشد ، نیز استفاده می کند. https://t.co/CO5d4BHiwa
Post summary
A new Linux‑targeting variant of the C0XMO botnet has been released; it scans SSH, brute‑forces credentials, and exploits the CVE‑2021‑27137 buffer‑overflow flaw.
0000157
202 followersView on X
SecEngCyGy@snypet8677d
Active Exploitation
CISA KEV: DD-WRT UPnP overflow CVE-2021-27137 (due Jul 24). Unauth stack overflow via M-SEARCH when UPnP is on. C0XMO/Gafgyt already abuse it. Action: firmware past build 45723 (45724+), or disable UPnP. Don't expose SSDP. https://nvd.nist.gov/vuln/detail/CVE-2021-27137 #CISA
Post summary
CISA declared an active exploitation notice for DD‑WRT’s UPnP stack‑overflow (CVE‑2021‑27137) with evidence of the Gafgyt malware already abusing it; firmware updates or disabling UPnP are recommended mitigations.
0000031
23 followersView on X
PJ@Npj844882d
Disclosure
#CVE-2021-27137 — DD-WRT Stack-Based Buffer Overflow Vulnerability https://pranithjain.qzz.io/blog/cve-2021-27137-cve-2021-27137-dd-wrt-stack-based-buffer
Post summary
The tweet announces CVE-2021-27137 as a stack-based buffer overflow in DD-WRT, providing a link to a blog post for further details.
0000039
50 followersView on X
takenaka hiroya@Joe_Biden_ja87d
Disclosure
新しい脆弱性情報「CVE-2021-27137」について記事を公開しました。関連するシステムを利用されている方は、内容をご確認の上、早めの対応を検討されることをおすすめします。 https://cve.autoarticles.net/cve/CVE-2021-27137
Post summary
An article announcing the new vulnerability CVE-2021-27137 has been published, advising affected users to review it and consider early remediation, with no additional technical or exploit details provided.
0000064
561 followersView on X
NotCVE@notCVE87d
General
🎯 Most likely to be exploited next (EPSS): • CVE-2026-63030 — EPSS 38.6% · CVSS 10 • CVE-2026-60137 — EPSS 20.4% · CVSS 10 • CVE-2021-27137 — EPSS 10.8% · CVSS 8.1 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-07-23.md
Post summary
The tweet enumerates three CVEs with high EPSS and CVSS scores, suggesting they may be targeted soon, but offers no proof of concept, exploit details, patch information, or evidence of current exploitation.
0000050
62 followersView on X
Vistem Solutions@VistemSolutions89d
Patch
CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability (CVSS 8.1) | Recent Breaches CVE-2021-27137 affects DD-WRT and is listed in CISA’s Known Exploited Vulnerabilities catalog, meaning it has been exploited in the wild. The flaw exists in router/upnp/src/ssdp.c in DD-WRT before build 45724, where an unsafe strcpy operation can trigger a stack-based buffer overflow. Recommended actions: ✅ Upgrade DD-WRT to build 45724 or later ✅ Disable UPnP/SSDP if not required ✅ Restrict router management access from the internet ✅ Review exposed edge devices and router logs ✅ Prioritize patching for any internet-facing DD-WRT systems Small vulnerabilities can create big business risks. Staying secure starts with visibility, patch discipline, and proactive cybersecurity planning. Ready to strengthen your cyber resilience? Vistem Solutions can help you elevate security, compliance, and operational confidence. 📩 sales@vistem.com #VistemSolutions #VistemElevate #Cybersecurity #CyberResilience #CVE #VulnerabilityManagement #PatchManagement #ITSecurity #BusinessSecurity #SecureInnovation #MSPExpertise https://recentbreaches.com/vulnerability/CVE-2021-27137?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer
Post summary
The advisory informs that DD‑WRT’s CVE‑2021‑27137 has been exploited in the wild and provides technical details of the stack‑overflow flaw, then offers clear patching and hardening measures.
0000037
79 followersView on X
Security Arsenal, LLC@SecurityAr5840989d
Active Exploitation
🔒 #CyberSecurity Active Exploitation of DD-WRT Routers: CVE-2021-27137 CISA KEV Alert "While CVE-2021-27137 was disclosed several years ago, the threat landscape has shifted…" 🔗 https://securityarsenal.com/blog/active-exploitation-of-dd-wrt-routers-cve-2021-27137-cisa-kev-alert #CyberSecurity #ThreatIntel #cve202127137 #critical #cisakev
Post summary
The post announces that CVE-2021-27137 is being actively exploited against DD‑WRT routers and references a CISA KEV alert, but it does not provide a PoC, patch details, or technical specifics.
0000042
19 followersView on X
SecAlerts@SecAlertsCo89d
Active Exploitation
📡 DD-WRT routers are being actively exploited by the c0xmo botnet via CVE-2021-27137, a stack buffer overflow in UPnP SSDP handling. No auth needed. Now KEV-listed. Patch to build 45724+. #NetworkSecurity #infosec https://secalerts.co/vulnerability/CVE-2021-27137?utm_campaign=x https://t.co/1YzJHEaPZQ
Post summary
The tweet confirms DD-WRT routers are being actively exploited via CVE-2021-27137, provides a patch version, and classifies the vulnerability as KEV-listed.
00000108
867 followersView on X
CiberPlaneta@CiberPlanetaOrg89d
Disclosure
🛡️ Alerta de Seguridad: Desbordamiento de Búfer en Pila vía UPnP en DD-WRT (CVE-2021-27137) DD-WRT presenta un stack-based buffer overflow en el componente UPnP (CWE-121, CVSS 8.1). Permite RCE no autenticado. CISA KEV: fecha límite FCEB 2026-07-24. https://www.ciberplaneta.org/boletines/129/ #ciberplaneta #bulletin #cybersecurity #cve #dd_wrt #ioc #upnp #rce #stack_buffer_overflow #cwe_121 #cisa_kev #router #firmware #infosec #ciberseguridad
Post summary
The bulletin announces a stack-based buffer overflow in DD-WRT’s UPnP component (CVE-2021-27137) with unauthenticated RCE capabilities and technical details, but no PoC, exploit, or active exploitation is reported.
0000046
7 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	dd-wrt	dd-wrt	-	-	-

Explore more

Back to dashboard dd-wrt CVEs dd-wrt vulnerabilities

What researchers are saying

CVE-2021-27137

DFIR Radar[verified]@DFIR_RadarActive Exploitation

The post details a real‑world exploitation of CVE-2021-27137 in DD‑WRT routers, outlining specific attack vectors and operational mechanisms.

FortiGuard Labs[verified]@FortiGuardLabsActive Exploitation

Researchers discovered a new Gafgyt botnet variant, C0XMO, that actively exploits CVE‑2021‑27137 on DD‑WRT routers and adds lateral movement via a Python script.

DFIR Radar[verified]@DFIR_RadarActive Exploitation

The tweet reports that the C0XMO botnet variant actively exploits CVE-2021-27137 in DD‑WRT routers, showcasing its persistence and anti‑malware capabilities, but provides no PoC, exploit code, or patch information.

Rahmi Demir ⭐⭐⭐⭐⭐[verified]@rahmid3mirDisclosure

The bulletin discloses a stack‑based buffer overflow (CVE‑2021‑27137) in DD‑WRT that enables remote code execution and recommends applying security updates and disabling UPnP to mitigate the risk.

Elusive[verified]@ElusivePrivacyActive Exploitation

C0XMO botnet is actively exploiting CVE-2021‑27137, a stack buffer overflow in UPnP, with evidence of cross‑platform usage, but no PoC or patch details are provided.

CyberX[verified]@CyberXlx9qActive Exploitation

The post highlights a new botnet variant (C0XMO) that is actively exploiting the DD‑WRT router vulnerability CVE‑2021‑27137 to compromise devices and build a large DDoS network, underscoring the risk to unpatched edge devices.

CyberAlertsHQ[verified]@CyberAlertsHQActive Exploitation

The tweet reports that CVE-2021-27137 is actively exploited by the C0xmo botnet via a DD‑WRT router flaw, provides mitigation steps, and offers technical details about the attack.

SecPod[verified]@SecPodActive Exploitation

C0XMO Gafgyt is actively exploiting CVE-2021-27137 in DD‑WRT routers, spreading across Linux systems to launch DDoS attacks, but no PoC, exploit code, patch, or technical details are provided.