CVE-2021-27137

Name of the Vulnerable Software and Affected Versions DD-WRT versions prior to 45724

Description An unsafe strcpy function in the UPnP handling functionality within router/upnp/src/ssdp.c allows an unauthenticated remote attacker to overflow an internal fixed buffer. This issue is triggered via an M-SEARCH request processed by the ssdp msearch() function, specifically when large ST:uuid values are handled incorrectly over UDP port 1900. Exploitation requires the user to have UPnP enabled. This flaw has been exploited by the C0xmo botnet, a Gafgyt variant, to compromise devices across multiple architectures including ARM, MIPS, PowerPC, SuperH, MC68000, Intel 80386, and AMD64. A confirmed incident involved a Japanese technology firm where the attack originated from an IP address in Germany.

Recommendations Update DD-WRT to version 45724 or later. Disable UPnP on port 1900.