DD-WRT UPnP flaw CVE-2021-27137 exploited by C0XMO botnet; firmware coverage unverified
Attackers are exploiting an old DD-WRT router flaw when UPnP is enabled and reachable. The source fix is revision 45724; firmware coverage is unverified. Disable UPnP and ask your router administrator to check its firmware.
If your router runs DD-WRT, disable UPnP. Ask whoever manages it to install firmware specifically for your router model containing revision 45724 or later, and confirm that its UPnP service is not exposed to the internet.
- DD-WRTfixed in 45724 and later
What’s happening
CVE-2021-27137 affects DD-WRT router firmware before revision 45724. A buffer overflow in UPnP, a feature that helps devices discover network services, can let an attacker run code without logging in. UPnP must be enabled: it is off by default and normally accepts traffic only from the local network, so this is not automatically an internet-wide exposure. The flaw was disclosed in March 2021; DD-WRT’s response quoted by SSD identified a source fix and promised firmware releases. Fortinet reported C0XMO botnet exploitation in June 2026, following discovery in March, and CISA listed the flaw on 21 July. Fortinet’s affected-version heading says before 45723, while the CVE record says before 45724; the latter matches the fix revision identified by DD-WRT. As at 3 November, model-specific firmware release coverage could not be verified because the vendor pages were inaccessible. No later resolution of the reported campaign was found.
- What
- Flaw
- Affects
- DD-WRT router firmware
- Affected
- DD-WRT revisions before 45724, when UPnP is enabled and reachable
- Fixed in
- DD-WRT source revision 45724; model-specific firmware release coverage unverified
- Since
- 21 July 2026
- Closed
- 21 July 2026
Timeline
- CISA added
CISA added CVE-2021-27137 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. Its entry set a federal remediation deadline of 24 July.
- Update
The CVE record was published, identifying DD-WRT revisions before 45724 as affected. It specifies that UPnP must be enabled and normally listens only on internal network interfaces.
- Wider attacks
Fortinet reported that it had discovered C0XMO botnet attacks exploiting CVE-2021-27137 in March 2026, including an attack targeting a Japanese technology company. The malware can recruit compromised devices for denial-of-service attacks.
- Made publicPartly fixed
SSD disclosed the DD-WRT UPnP buffer overflow. DD-WRT’s response, reproduced in the advisory, identified revision 45724 as the source fix and said firmware releases would follow.
Sources
- SSD Advisory – DD-WRT UPNP Buffer Overflow, including DD-WRT’s responseSSD Secure Disclosure · 24 Mar 2021
- Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMOFortinet · 3 June 2026
- C0XMO botnet spreads via DD-WRT router flaw, kills rival malwareBleepingComputer · 7 June 2026
- CVE-2021-27137 Detail, including CISA exploitation listingNIST · 22 July 2026