erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: March 24, 2021

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet. Owners of routers running DD-WRT builds before 45724, including Buffalo models that ship DD-WRT firmware, especially where UPnP is enabled or the device has not been updated since 2021.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2021-27137

DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet

Only routers running an old DD-WRT build with UPnP turned on are at risk; find any you own, update or retire them, and switch UPnP off where nobody needs it.

Must act: Owners of routers running DD-WRT builds before 45724, including Buffalo models that ship DD-WRT firmware, especially where UPnP is enabled or the device has not been updated since 2021.

Can relax: Teams with no DD-WRT devices, and DD-WRT routers on build 45724 or later or with UPnP left at its default of off.

  1. Find every router running DD-WRT, including Buffalo OEM firmware and lab or branch-office devices, and read its build number.
  2. Update anything older than build 45724 to a current DD-WRT build or the vendor's latest firmware; replace hardware that gets no updates.
  3. Disable UPnP unless a specific device needs it, and confirm UDP 1900 (SSDP) is not reachable from the WAN side.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.