---
title: "DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet"
url: https://erroneo.us/security/briefs/dd-wrt-upnp-ssdp-overflow-cve-2021-27137/
description: "A 2021 DD-WRT UPnP stack overflow, fixed in build 45724, is now spread by the C0XMO botnet and in CISA KEV. Check DD-WRT routers; most teams can relax."
type: security-brief
section: "Security Digest"
date_published: 2021-03-24
date_modified: 2026-07-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-27137"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# DD-WRT CVE-2021-27137: UPnP Overflow Used by C0XMO Botnet

**Verdict: Check exposure.** Only routers running an old DD-WRT build with UPnP turned on are at risk; find any you own, update or retire them, and switch UPnP off where nobody needs it.

- **Who must act:** Owners of routers running DD-WRT builds before 45724, including Buffalo models that ship DD-WRT firmware, especially where UPnP is enabled or the device has not been updated since 2021.
- **Who can relax:** Teams with no DD-WRT devices, and DD-WRT routers on build 45724 or later or with UPnP left at its default of off.
- **Affected:** DD-WRT builds before 45724 (SSD: changeset 45723 and earlier); Buffalo routers shipping DD-WRT-based firmware built before the fix; Only when the UPnP service is enabled (off by default)
- **Fixed:** DD-WRT builds from changeset 45724 onward
- **CVEs:** CVE-2021-27137
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every router running DD-WRT, including Buffalo OEM firmware and lab or branch-office devices, and read its build number.
2. Update anything older than build 45724 to a current DD-WRT build or the vendor's latest firmware; replace hardware that gets no updates.
3. Disable UPnP unless a specific device needs it, and confirm UDP 1900 (SSDP) is not reachable from the WAN side.
4. Disable Telnet and change default or weak admin passwords; C0XMO also brute-forces Telnet and SSH.
5. Block router-originated traffic to the C0XMO infrastructure listed by FortiGuard Labs.

### How to check if you are affected

- On DD-WRT devices with a shell, look for /tmp/.sys, /var/tmp/.sys or /dev/shm/.sys and for a cron job that runs every 15 minutes.
- Check for outbound connections to 85.215.131.70, 217.160.125.125:15527 or 176.100.37.91.
- Watch for UPnP daemon crashes and oversized M-SEARCH requests on UDP 1900.
- Flag routers that start scanning ports 22, 23, 80, 443, 7547 or 8080 on other hosts.

## What happened

On March 24, 2021, [SSD Secure Disclosure](https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/) published a stack buffer overflow in the UPnP service of DD-WRT, the open-source router firmware. In `ssdp_msearch`, an M-SEARCH request is copied with an unsafe `strcpy` into a fixed 128-byte buffer. An unauthenticated attacker who can reach the service can crash it and may be able to run code. The advisory included a Python proof of concept. DD-WRT fixed the bug in [changeset 45724](https://svn.dd-wrt.com/changeset/45724).

The bug stayed obscure for five years. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2021-27137) was reserved in 2021 but only published on July 16, 2026, with a CVSS 3.1 score of 8.1 (High, attack complexity high). Its references point to the reason. [FortiGuard Labs](https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo) reported on June 3 that it had found a new Gafgyt botnet variant, C0XMO, in March that "spreads by exploiting CVE-2021-27137". CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137) on July 21, 2026, with a federal deadline of July 24.

## Who is affected

DD-WRT builds before 45724 are affected. SSD also says Buffalo devices that ship DD-WRT should be considered vulnerable. Three conditions narrow this a lot. The CVE record says UPnP is off by default and listens only on internal interfaces by default. SSD describes the attacker as "sitting on the LAN". DD-WRT is aftermarket firmware, so an update usually means someone reflashing the router by hand. A device left on a build from before the 2021 fix is vulnerable if UPnP was ever turned on.

## Do you really need to act?

Most companies can relax. They do not run DD-WRT, or their routers are newer than a 2021 build. The people who should check are small offices, labs, retail sites and remote workers on hand-flashed or Buffalo-branded routers.

The KEV listing is real evidence of use, not a theoretical risk. C0XMO exploits the bug with crafted M-SEARCH requests on UDP port 1900. It ships builds for ARM, MIPS, PowerPC, SuperH and x86. It persists with cron jobs, kills rival botnets and offers 19 DDoS methods. Fortinet saw it target a Japanese technology firm. Neither Fortinet nor [BleepingComputer](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/) gives a device count. Neither explains how the bot reaches a service that listens only on the LAN by default. Expect the risk to concentrate on routers where UPnP was enabled and exposed, and on networks that already have an infected host inside. C0XMO's separate scanner also brute-forces Telnet and SSH, so weak router passwords are a second way in.

[NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-27137) shows only the CNA's 8.1 score, plus CISA's assessment that exploitation is active but not automatable. That fits a bug that needs a non-default setting.

## What to do now

1. Find every DD-WRT router you own and read the build number from its firmware version string. Anything below 45724 is vulnerable.
2. Flash a current DD-WRT build, or the vendor's latest firmware for Buffalo devices. Hardware that no longer gets builds should be replaced, not left running.
3. Turn UPnP off unless a specific device needs it. From outside your network, confirm that UDP 1900 does not answer on the WAN address.
4. Disable Telnet, use SSH keys or strong unique passwords, and keep the web admin interface off the WAN.
5. Block outbound traffic to the C0XMO hosts FortiGuard lists: `85.215.131.70`, `217.160.125.125` and `176.100.37.91`.

## How to tell if you were hit

On a router with shell access, look for files named `.sys` in `/tmp`, `/var/tmp`, `/dev/shm` or the home directory. Check `crontab -l` for a job that runs every 15 minutes and look for launch lines added to shell profiles, which are the persistence FortiGuard describes. At the network edge, look for router-originated connections to the hosts above, for the router scanning other machines on ports 22, 23, 80, 443, 7547 or 8080, and for unexplained outbound floods. Frequent UPnP daemon crashes or malformed M-SEARCH requests with long `ST: uuid:` values point to exploitation attempts. If a router shows any of these, reflash it from a clean image, reset its credentials, and check the hosts behind it.

## Timeline

- Mar 24, 2021 — SSD publishes the advisory and proof of concept, naming DD-WRT changeset 45724 as the fix.
- Mar 2026 — FortiGuard Labs discovers the C0XMO botnet exploiting the bug.
- Jun 3, 2026 — FortiGuard publishes its C0XMO analysis. BleepingComputer covers it on June 7.
- Jul 16, 2026 — The CVE record for CVE-2021-27137 is published.
- Jul 21, 2026 — CISA adds the CVE to KEV, with a federal deadline of July 24.

## Sources

1. [SSD Secure Disclosure — DD-WRT UPnP buffer overflow advisory (Mar 24, 2021)](https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/)
2. [DD-WRT — changeset 45724 (fix)](https://svn.dd-wrt.com/changeset/45724)
3. [CVE record — CVE-2021-27137](https://www.cve.org/CVERecord?id=CVE-2021-27137)
4. [NVD — CVE-2021-27137](https://nvd.nist.gov/vuln/detail/CVE-2021-27137)
5. [CISA — Known Exploited Vulnerabilities: CVE-2021-27137](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137)
6. [FortiGuard Labs — Inside cross-platform propagation of new Gafgyt variant C0XMO](https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo)
7. [BleepingComputer — C0XMO botnet spreads via DD-WRT router flaw, kills rival malware](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/)

---
Source page: https://erroneo.us/security/briefs/dd-wrt-upnp-ssdp-overflow-cve-2021-27137/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt