CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdpmsearch (reachable by an M-SEARCH request).
Other sources
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DD-WRT/router/upnp/src/ssdp.cto a version that resolves this vulnerability.Fixed in 45724 - Configuration
Ensure UPnP is disabled (UPnP is off by default; exploitation requires the DD-WRT user to enable UPnP).
DD-WRT UPnP UPnP = disable - Compensating control
Ensure UPnP exposure is limited to internal interfaces only (UPnP listens on internal interfaces by default; avoid exposing UPnP/SSDP to the internet).
- Operational
If UPnP was enabled and potentially reachable, evaluate whether any compromise indicators exist and perform incident-response/forensics triage in accordance with CISA’s “Forensics Triage Requirements”.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-27137?
CVE-2021-27137 has a severity score of 8.1, indicating a high risk vulnerability.
How do I fix CVE-2021-27137?
To fix CVE-2021-27137, disable UPnP on your DD-WRT router or update to a patched version after 45724.
What type of vulnerability is CVE-2021-27137?
CVE-2021-27137 is a stack-based buffer overflow vulnerability affecting the UPnP functionality.
Who is affected by CVE-2021-27137?
Users of DD-WRT firmware versions before 45724 that have UPnP enabled are vulnerable to CVE-2021-27137.
Can CVE-2021-27137 be exploited remotely?
Yes, CVE-2021-27137 can be exploited by an unauthenticated remote attacker if UPnP is enabled.