{"history":[{"alert":0,"cve":"CVE-2021-27137","id":22089,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.03995, \"percentile\": 0.90664}"},{"alert":0,"cve":"CVE-2021-27137","id":19708,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.03995, \"percentile\": 0.90606}"},{"alert":0,"cve":"CVE-2021-27137","id":17674,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.03995, \"percentile\": 0.90594}"},{"alert":0,"cve":"CVE-2021-27137","id":15738,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.03995, \"percentile\": 0.90588}"},{"alert":0,"cve":"CVE-2021-27137","id":13716,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.03995, \"percentile\": 0.90582}"},{"alert":0,"cve":"CVE-2021-27137","id":11498,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.03995, \"percentile\": 0.90566}"},{"alert":0,"cve":"CVE-2021-27137","id":9484,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.03995, \"percentile\": 0.90558}"},{"alert":1,"cve":"CVE-2021-27137","id":8500,"kind":"cna","observed_at":1793895600,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2021-27137\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-07-21T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-07-21\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-07-22T03:55:45.793Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"exploit\"], \"url\": \"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-21T00:00:00.000Z\", \"value\": \"CVE-2021-27137 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"DD-WRT\", \"vendor\": \"DD-WRT\", \"versions\": [{\"lessThan\": \"45724\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:dd-wrt:dd-wrt:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"45724\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-121\", \"description\": \"CWE-121 Stack-based Buffer Overflow\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-07-16T17:38:47.947Z\", \"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\"}, \"references\": [{\"url\": \"https://svn.dd-wrt.com/changeset/45724\"}, {\"url\": \"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/\"}, {\"url\": \"https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html\"}, {\"url\": \"https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/\"}, {\"url\": \"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo\"}], \"x_generator\": {\"engine\": \"enrichogram 0.0.1\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"assignerShortName\": \"mitre\", \"cveId\": \"CVE-2021-27137\", \"datePublished\": \"2026-07-16T00:00:00.000Z\", \"dateReserved\": \"2021-02-10T00:00:00.000Z\", \"dateUpdated\": \"2026-07-22T03:55:45.793Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2021-27137","id":7032,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.03995, \"percentile\": 0.9055}"},{"alert":0,"cve":"CVE-2021-27137","id":4809,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.03995, \"percentile\": 0.90533}"},{"alert":0,"cve":"CVE-2021-27137","id":2591,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.03995, \"percentile\": 0.90521}"},{"alert":1,"cve":"CVE-2021-27137","id":119,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2021-27137\", \"cwes\": [\"CWE-121\"], \"dateAdded\": \"2026-07-21\", \"dueDate\": \"2026-07-24\", \"forensicTriage\": \"Yes\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137\", \"product\": \"DD-WRT\", \"requiredAction\": \"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\\u2019s \\u201cForensics Triage Requirements\\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\", \"shortDescription\": \"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.\", \"vendorProject\": \"DD-WRT\", \"vulnerabilityName\": \"DD-WRT Stack-Based Buffer Overflow Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"DD-WRT","vendor":"DD-WRT","versions":[{"lessThan":"45724","status":"affected","version":"0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2021-27137","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-21T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-07-22T03:55:45.793Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137"}],"timeline":[{"lang":"en","time":"2026-07-21T00:00:00.000Z","value":"CVE-2021-27137 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"DD-WRT","vendor":"DD-WRT","versions":[{"lessThan":"45724","status":"affected","version":"0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dd-wrt:dd-wrt:*:*:*:*:*:*:*:*","versionEndExcluding":"45724","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request)."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","description":"CWE-121 Stack-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-16T17:38:47.947Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"url":"https://svn.dd-wrt.com/changeset/45724"},{"url":"https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/"},{"url":"https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html"},{"url":"https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/"},{"url":"https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo"}],"x_generator":{"engine":"enrichogram 0.0.1"}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2021-27137","datePublished":"2026-07-16T00:00:00.000Z","dateReserved":"2021-02-10T00:00:00.000Z","dateUpdated":"2026-07-22T03:55:45.793Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794370801,"cve":"CVE-2021-27137","description":"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).","epss":{"date":"2026-11-12","epss":0.03995,"percentile":0.90664},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2021-27137","cwes":["CWE-121"],"dateAdded":"2026-07-21","dueDate":"2026-07-24","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137","product":"DD-WRT","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.","vendorProject":"DD-WRT","vulnerabilityName":"DD-WRT Stack-Based Buffer Overflow Vulnerability"},"kev_checked":1794522003,"products":"DD-WRT DD-WRT","references":["https://svn.dd-wrt.com/changeset/45724","https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html","https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/","https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137"],"score":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"mitre","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"DD-WRT Stack-Based Buffer Overflow Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}