{"id":"dd-wrt-upnp-botnet-attacks-jul-2026","category":"patch","status":"closed","title":"DD-WRT UPnP flaw CVE-2021-27137 exploited by C0XMO botnet; firmware coverage unverified","tldr":"Attackers are exploiting an old DD-WRT router flaw when UPnP is enabled and reachable. The source fix is revision 45724; firmware coverage is unverified. Disable UPnP and ask your router administrator to check its firmware.","summary":"CVE-2021-27137 affects DD-WRT router firmware before revision 45724. A buffer overflow in UPnP, a feature that helps devices discover network services, can let an attacker run code without logging in. UPnP must be enabled: it is off by default and normally accepts traffic only from the local network, so this is not automatically an internet-wide exposure. The flaw was disclosed in March 2021; DD-WRT’s response quoted by SSD identified a source fix and promised firmware releases. Fortinet reported C0XMO botnet exploitation in June 2026, following discovery in March, and CISA listed the flaw on 21 July. Fortinet’s affected-version heading says before 45723, while the CVE record says before 45724; the latter matches the fix revision identified by DD-WRT. As at 3 November, model-specific firmware release coverage could not be verified because the vendor pages were inaccessible. No later resolution of the reported campaign was found.","action":"If your router runs DD-WRT, disable UPnP. Ask whoever manages it to install firmware specifically for your router model containing revision 45724 or later, and confirm that its UPnP service is not exposed to the internet.","product":"DD-WRT router firmware","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2021-27137"],"tags":["dd-wrt","router","upnp","buffer-overflow","botnet"],"affected":["DD-WRT revisions before 45724, when UPnP is enabled and reachable"],"fixed":["DD-WRT source revision 45724; model-specific firmware release coverage unverified"],"matches":[{"platform":"router","app":"DD-WRT","bundle":"","fixed":"45724"}],"sources":[{"kind":"advisory","title":"SSD Advisory – DD-WRT UPNP Buffer Overflow, including DD-WRT’s response","url":"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","by":"SSD Secure Disclosure","date":"2021-03-24"},{"kind":"research","title":"Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO","url":"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","by":"Fortinet","date":"2026-06-03"},{"kind":"news","title":"C0XMO botnet spreads via DD-WRT router flaw, kills rival malware","url":"https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/","by":"BleepingComputer","date":"2026-06-07"},{"kind":"advisory","title":"CVE-2021-27137 Detail, including CISA exploitation listing","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27137","by":"NIST","date":"2026-07-22"}],"started":"2026-07-21","closed":"2026-07-21","created":"2026-11-03T22:14:41.350Z","updated":"2026-11-03T22:14:41.350Z","cve_notes":[{"cve":"CVE-2021-27137","name":"Stack buffer overflow in DD-WRT’s UPnP service","what":"An unchecked copy in DD-WRT’s UPnP service can let an unauthenticated attacker who can reach the enabled service overflow a stack buffer and run code on the router.","severity":"unknown","cvss":8.1}],"timeline":[{"at":"2026-07-21","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2021-27137 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. Its entry set a federal remediation deadline of 24 July.","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27137","by":"NIST","patch":null},{"at":"2026-07-16","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"The CVE record was published, identifying DD-WRT revisions before 45724 as affected. It specifies that UPnP must be enabled and normally listens only on internal network interfaces.","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27137","by":"NIST","patch":null},{"at":"2026-06-03","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Fortinet reported that it had discovered C0XMO botnet attacks exploiting CVE-2021-27137 in March 2026, including an attack targeting a Japanese technology company. The malware can recruit compromised devices for denial-of-service attacks.","url":"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","by":"Fortinet","patch":null},{"at":"2021-03-24","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"SSD disclosed the DD-WRT UPnP buffer overflow. DD-WRT’s response, reproduced in the advisory, identified revision 45724 as the source fix and said firmware releases would follow.","url":"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","by":"SSD Secure Disclosure","patch":"partial"}],"url":"https://hard.fyi/live/dd-wrt-upnp-botnet-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=dd-wrt-upnp-botnet-attacks-jul-2026"}