CVE-2021-27137

Summary

DD-WRT Stack-Based Buffer Overflow Vulnerability

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

Published 2026-07-21 · first seen here 2026-10-10

CISA required action (due 2026-07-24): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Where it shows in your logs

CISA requires forensic triage for this CVE (BOD 26-04): check affected systems for signs of compromise, don't just patch.

Server or web application · Memory corruption (overflow, use-after-free) medium confidence

What to look for

• Crashes or restarts of the vulnerable process (Windows Error Reporting, core dumps), especially repeated ones
• The vulnerable process spawning children it never normally starts
• The application's process (w3wp.exe, java, tomcat, node, php-fpm, httpd, python) starting shells or LOLBins (cmd, powershell, sh, bash, curl, wget, certutil)
• New script files in web roots (.jsp, .aspx, .php): a web shell
• Requests to unusual URLs on the application from internet IPs right before any of the above
• Outbound connections from the server to new external IPs

Data sources

A generic baseline worked out from the product type and weakness (CWE-121), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.

References

• NVD entry
• CISA KEV
• https://svn.dd-wrt.com/changeset/45724
• https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk