CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow

Exploited in the wild High 8.1 Published 16 Jul 2026 Updated 22 Jul 2026

An unauthenticated remote attacker can execute arbitrary code via a buffer overflow in UPnP handling if UPnP is enabled.

Exploited in the wild: Since 21 Jul 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27137?

CVE-2021-27137 is a high-severity memory corruption vulnerability in DD-WRT, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

Weakness: CWE-121

Which versions are affected by CVE-2021-27137?

It affects 1 product.

Products include Dd-Wrt Dd-Wrt.

How do I fix CVE-2021-27137?

No fix has been published for CVE-2021-27137 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Jul 2026.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-27137 being exploited?

Yes. Attackers have exploited CVE-2021-27137 in the wild since at least 21 Jul 2026.

Sources

Also known as GHSA-qx3v-2jx6-8m2c.