DD-WRT bug can take over routers
A flaw in DD-WRT can let an attacker run code on some routers. If it works, the router can be taken over and pulled into a botnet.
- Severity
- HighCVSS 3.1 · 8.1
- Fix
- Update availableFix recorded on Aug 26, 2026
- Affected versions
- before 45724
- Weakness
- CWE-121Stack-based Buffer Overflow
- Exploit likelihood
- 4.0% in 30 daysEPSS, higher than 90% of known flaws
- Affects
- DD-WRT
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Jul 21, 2026
- Federal fix deadline
- Jul 24, 2026
How it works
An attacker sends a fake UPnP discovery packet with an oversized ST:uuid value to UDP port 1900, which overflows DD-WRT memory before the router handles it safely.
What to do
In the DD-WRT web interface, compare the installed changeset or build with 45723.
Update DD-WRT to changeset 45723 or later through the normal firmware update process, and disable UPnP if it is not needed.
Technical details
CVE-2021-27137 is a stack buffer overflow in DD-WRT's UPnP service. The public advisory says UPnP is disabled by default and listens only on internal interfaces, so exploitation depends on that service being enabled and reachable from the local network. The trigger is an M-SEARCH request carrying an overlong ST:uuid value over UDP port 1900. Public reporting also ties the flaw to botnet use against vulnerable DD-WRT routers.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity High Attack depends on conditions outside the attacker's control
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculatorReferences
- svn.dd-wrt.com · changeset 45724 Patch
- securityaffairs.com · iot-botnet-c0xmo-adds-competitor-killing-capability.html Exploit Third Party Advisory
- ssd-disclosure.com · ssd-advisory-dd-wrt-upnp-buffer-overflow Exploit Third Party Advisory
- bleepingcomputer.com · c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware Exploit Third Party Advisory
- fortinet.com · inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo Exploit
- cisa.gov · known-exploited-vulnerabilities-catalog US Government Resource
- cisa.gov · cisa-adds-four-known-exploited-vulnerabilities-catalog CISA Advisory