DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet

What to do

1. Find every router running DD-WRT, including Buffalo OEM firmware and lab or branch-office devices, and read its build number.
2. Update anything older than build 45724 to a current DD-WRT build or the vendor's latest firmware; replace hardware that gets no updates.
3. Disable UPnP unless a specific device needs it, and confirm UDP 1900 (SSDP) is not reachable from the WAN side.
4. Disable Telnet and change default or weak admin passwords; C0XMO also brute-forces Telnet and SSH.
5. Block router-originated traffic to the C0XMO infrastructure listed by FortiGuard Labs.

How to check if you are affected or compromised

• On DD-WRT devices with a shell, look for /tmp/.sys, /var/tmp/.sys or /dev/shm/.sys and for a cron job that runs every 15 minutes.
• Check for outbound connections to 85.215.131.70, 217.160.125.125:15527 or 176.100.37.91.
• Watch for UPnP daemon crashes and oversized M-SEARCH requests on UDP 1900.
• Flag routers that start scanning ports 22, 23, 80, 443, 7547 or 8080 on other hosts.

What happened#

On March 24, 2021, SSD Secure Disclosure published a stack buffer overflow in the UPnP service of DD-WRT, the open-source router firmware. In ssdp_msearch, an M-SEARCH request is copied with an unsafe strcpy into a fixed 128-byte buffer. An unauthenticated attacker who can reach the service can crash it and may be able to run code. The advisory included a Python proof of concept. DD-WRT fixed the bug in changeset 45724.

The bug stayed obscure for five years. The CVE record was reserved in 2021 but only published on July 16, 2026, with a CVSS 3.1 score of 8.1 (High, attack complexity high). Its references point to the reason. FortiGuard Labs reported on June 3 that it had found a new Gafgyt botnet variant, C0XMO, in March that "spreads by exploiting CVE-2021-27137". CISA added the CVE to the KEV catalog on July 21, 2026, with a federal deadline of July 24.

Who is affected#

DD-WRT builds before 45724 are affected. SSD also says Buffalo devices that ship DD-WRT should be considered vulnerable. Three conditions narrow this a lot. The CVE record says UPnP is off by default and listens only on internal interfaces by default. SSD describes the attacker as "sitting on the LAN". DD-WRT is aftermarket firmware, so an update usually means someone reflashing the router by hand. A device left on a build from before the 2021 fix is vulnerable if UPnP was ever turned on.

Do you really need to act?#

Most companies can relax. They do not run DD-WRT, or their routers are newer than a 2021 build. The people who should check are small offices, labs, retail sites and remote workers on hand-flashed or Buffalo-branded routers.

The KEV listing is real evidence of use, not a theoretical risk. C0XMO exploits the bug with crafted M-SEARCH requests on UDP port 1900. It ships builds for ARM, MIPS, PowerPC, SuperH and x86. It persists with cron jobs, kills rival botnets and offers 19 DDoS methods. Fortinet saw it target a Japanese technology firm. Neither Fortinet nor BleepingComputer gives a device count. Neither explains how the bot reaches a service that listens only on the LAN by default. Expect the risk to concentrate on routers where UPnP was enabled and exposed, and on networks that already have an infected host inside. C0XMO's separate scanner also brute-forces Telnet and SSH, so weak router passwords are a second way in.

NVD shows only the CNA's 8.1 score, plus CISA's assessment that exploitation is active but not automatable. That fits a bug that needs a non-default setting.

What to do now#

1. Find every DD-WRT router you own and read the build number from its firmware version string. Anything below 45724 is vulnerable.
2. Flash a current DD-WRT build, or the vendor's latest firmware for Buffalo devices. Hardware that no longer gets builds should be replaced, not left running.
3. Turn UPnP off unless a specific device needs it. From outside your network, confirm that UDP 1900 does not answer on the WAN address.
4. Disable Telnet, use SSH keys or strong unique passwords, and keep the web admin interface off the WAN.
5. Block outbound traffic to the C0XMO hosts FortiGuard lists: 85.215.131.70, 217.160.125.125 and 176.100.37.91.

How to tell if you were hit#

On a router with shell access, look for files named .sys in /tmp, /var/tmp, /dev/shm or the home directory. Check crontab -l for a job that runs every 15 minutes and look for launch lines added to shell profiles, which are the persistence FortiGuard describes. At the network edge, look for router-originated connections to the hosts above, for the router scanning other machines on ports 22, 23, 80, 443, 7547 or 8080, and for unexplained outbound floods. Frequent UPnP daemon crashes or malformed M-SEARCH requests with long ST: uuid: values point to exploitation attempts. If a router shows any of these, reflash it from a clean image, reset its credentials, and check the hosts behind it.

Timeline#

• Mar 24, 2021 — SSD publishes the advisory and proof of concept, naming DD-WRT changeset 45724 as the fix.
• Mar 2026 — FortiGuard Labs discovers the C0XMO botnet exploiting the bug.
• Jun 3, 2026 — FortiGuard publishes its C0XMO analysis. BleepingComputer covers it on June 7.
• Jul 16, 2026 — The CVE record for CVE-2021-27137 is published.
• Jul 21, 2026 — CISA adds the CVE to KEV, with a federal deadline of July 24.

Vulnerability records

• CVE-2021-27137 · KEV 2026-07-21 · An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SSD Secure Disclosure — DD-WRT UPnP buffer overflow advisory (Mar 24, 2021) ssd-disclosure.com
2. DD-WRT — changeset 45724 (fix) svn.dd-wrt.com
3. CVE record — CVE-2021-27137 cve.org
4. NVD — CVE-2021-27137 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2021-27137 cisa.gov
6. FortiGuard Labs — Inside cross-platform propagation of new Gafgyt variant C0XMO fortinet.com

Coverage and analysis

1. BleepingComputer — C0XMO botnet spreads via DD-WRT router flaw, kills rival malware bleepingcomputer.com