CVE-2021-27137

HIGH8.1

CISA KEV

Published 2026-07-16 · Updated 2026-07-22 · Source cve@mitre.org

Summary

CVE-2021-27137 is a high-severity (CVSS 8.1) vulnerability in DD-WRT DD-WRT. CISA added it to the Known Exploited Vulnerabilities catalog on July 21, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 24, 2026. CISA does not currently list it as used in ransomware campaigns.

All 1 known-exploited DD-WRT vulnerabilities →

Description

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-121

CISA Known-Exploited Vulnerability

Product: DD-WRT — DD-WRT

Name: DD-WRT Stack-Based Buffer Overflow Vulnerability

Date added: 2026-07-21 · Due: 2026-07-24

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-28328
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
2026-10-20 · score 8.8
CVE-2026-113658
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.
2026-10-20 · score 7.5
CVE-2026-113682
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
2026-10-20 · score 7.4
CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
2026-10-20 · score 7.0
CVE-2026-113613
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
2026-10-20 · score 8.1