Vulnerabilities
3 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27137 | Unauthenticated Stack-Based Buffer Overflow in DD-WRT UPnP (SSDP M-SEARCH) DD-WRT firmware before build 45724 contains a stack-based buffer overflow (CWE-121) caused by an unsafe strcpy in the UPnP handling code (ssdp_msearch in router/upnp/src/ssdp.c). An unauthenticated remote attacker can trigger it by sending a crafted SSDP M-SEARCH request to a UPnP-enabled interface, overflowing an internal fixed buffer. Successful exploitation can crash the router or allow code execution and full device compromise, consistent with the high confidentiality, integrity and availability impacts in the 8.1 CVSS score. Exposure is limited because UPnP is disabled by default and, by default, listens only on internal interfaces, so risk is concentrated on DD-WRT routers where UPnP has been enabled and on networks where an attacker has LAN access. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, has public proofs of concept, and is reportedly being exploited in the wild by the C0XMO IoT botnet (a Gafgyt variant) to propagate and remove rival malware. Do: Upgrade affected DD-WRT routers to build 45724 or later. If upgrading is not immediately possible, disable UPnP, or verify that UPnP/SSDP is bound only to internal interfaces and that UDP port 1900 (SSDP) and M-SEARCH traffic are not reachable from the WAN. Per the CISA KEV required action, apply mitigations in line with BOD 26-04 guidance, and check any internet-exposed DD-WRT device for signs of compromise (e.g., unexpected botnet traffic) if UPnP was enabled. | 8.1 | 4% | KEV PoC ×4 |
| large≈ hundreds of thousands of DD-WRT routers, of which only the subset with UPnP enabled is actually exploitable | |
| CVE-2022-27631 | A memory corruption vulnerability exists in the httpd unescape functionality of DD-WRT Revision 32270 - Revision 48599. A memory corruption vulnerability exists in the httpd unescape functionality of DD-WRT Revision 32270 - Revision 48599. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2020-13976 | An issue was discovered in DD-WRT through 16214. An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it refers to an old software version, requires administrative privileges, and does not provide access beyond that already available to administrative users NVD description · AI analysis pending | 8.8 | 2% | PoC |
| — |