CVE-2021-27137

What the flaw is

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

Description as published by CISA. We have not independently reproduced it.

What CISA requires

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

This deadline is binding on US federal civilian agencies under BOD 22-01. It is not a legal deadline for anyone else, but it is a useful urgency signal — CISA sets it by how actively the flaw is being used, not by CVSS.

Public exploit code

9 public repositories referencing this CVE have been catalogued on GitHub. Treat this as a strong signal to prioritise patching, not as a verified working exploit — many such repositories are scanners, write-ups or forks rather than functional code.

• 0day404/vulnerability-poc
• ArrestX/--POC
• KayCHENvip/vulnerability-poc
• SexyBeast233/SecBooks
• Threekiii/Awesome-POC
• XiaomingX/awesome-poc-for-red-team
• d4n-sec/d4n-sec.github.io
• intercladire/Awesome-POC

Showing 8 of 9. Full list in the trickest/cve dataset.

Vendor advisories

• svn.dd-wrt.com/changeset/45724
• www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-ba
• www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioriti
• nvd.nist.gov/vuln/detail/CVE-2021-27137

Primary sources

• NVD entry — CVSS score, CPE list and references
• CISA KEV catalog — the source for this page
• CVE Record at cve.org