CVE-2021-27137

CVE-2021-27137 is a buffer overflow in DD-WRT's UPnP SSDP handler (ssdp.c) where an unbounded strcpy copies data from incoming M-SEARCH packets without bounds checking. The vulnerability is exploitable via a single crafted packet and yields unauthenticated code execution on the router. CISA's KEV catalog lists this as actively exploited in the wild, and the EPSS score of 0.16488 confirms exploitation is targeted rather than mass-scanned. The 'default off' characterization in most advisories obscures the actual risk for DD-WRT deployments. DD-WRT users are not typical consumer router owners — they are precisely the population whose original firmware reached end-of-life and who replaced it for more control. These users disproportionately enable UPnP for gaming consoles, VoIP handsets, and peer-to-peer applications. The 'default off' toggle isn't a security control in this context; it's a predictor of exposure. If your DD-WRT router has UPnP enabled, you're in the exploitation window regardless of what the default setting was. The 'internal interfaces only' constraint provides even less protection than it appears. For a router, the internal interface is the entire LAN segment the device protects — it's the trust boundary, not a protective layer. An attacker who can reach the internal interface (which includes any compromised host on your network, any malicious WiFi client, or any guest device) doesn't need to chain vulnerabilities. One M-SEARCH packet gets you code execution on the gateway. From there, the attacker controls DNS, DHCP, routing, and every device on that network segment. Check your DD-WRT devices now. If UPnP is enabled and the firmware is older than the patch release (version 45722 or earlier), treat this as urgent: either update immediately or disable UPnP if you don't need it. If you do need UPnP for legitimate services, understand that you're accepting unauthenticated code execution on your network gateway as a trade-off — not a minor one. Consider network segmentation to limit the blast radius of router compromise, and monitor for unexpected changes in DHCP assignments or DNS servers, which are the first indicators of a compromised gateway.

Reviewed through automated stages and approved by a human before publication.