DD-WRT UPnP Stack-Based Buffer Overflow (CVE-2021-27137)

Historical catalog analysis: CISA added this entry on July 21, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-27137 is a stack-based buffer overflow (CWE-121) identified in DD-WRT firmware. The flaw exists within an internal buffer used by the Universal Plug and Play (UPnP) protocol. An unauthenticated remote attacker could potentially overflow this buffer to trigger arbitrary code execution on the affected device.

Exposure and applicability

This vulnerability applies to devices running DD-WRT firmware where UPnP is enabled and accessible to the attacker. Because UPnP is often used for automated port mapping and device discovery, exposure depends on whether the service is exposed to untrusted networks or if an attacker has already gained a foothold within the local network.

Remediation priorities

Our analysis suggests prioritizing remediation based on the device’s position in the network architecture (e.g., edge routers versus internal access points).

1. Firmware Update: The primary corrective action is to apply the fix provided by the vendor. Specifically, defenders should reference changeset 45724 from the DD-WRT SVN repository to ensure the buffer overflow is addressed.
2. Service Reduction: For environments where UPnP functionality is not strictly required for business operations, disabling the service entirely could reduce the attack surface and eliminate the primary entry path for this specific vulnerability.
3. Network Segmentation: Restricting access to the management interfaces and UPnP ports via firewall rules can limit the ability of unauthenticated remote attackers to reach the vulnerable buffer.

How to validate remediation

Verification must move beyond simple version checks, as firmware builds may vary.

• Changeset Verification: Infrastructure owners should verify that the deployed firmware build incorporates changeset 45724.
• Configuration Audit: Confirm that UPnP is disabled on all devices where it is not required.
• Exposure Testing: Use authorized network scanning tools to confirm that UPnP ports are no longer reachable from untrusted network segments.

It is important to note that while these steps reduce exposure, they do not guarantee the absence of other vulnerabilities within the firmware stack.

Limits and open questions

There is currently uncertainty regarding which specific versions of DD-WRT are affected beyond those corrected by the referenced changeset. Additionally, because DD-WRT is often deployed in diverse hardware environments, the effectiveness of a fix may vary across different device architectures. Residual risk remains if the firmware is updated but UPnP is left enabled on an exposed interface without additional compensating controls.

Source and editorial note

CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability · Source date: July 21, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: July 24, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 02, 2026 at 03:17 UTC.

Request a Vulnerability Assessment