CISA Adds DD-WRT Buffer Overflow Vulnerability to KEV List

## Overview CISA added CVE-2021-27137 to its Known Exploited Vulnerabilities (KEV) list on July 21, 2026. This vulnerability affects DD-WRT versions prior to 45724. It involves a stack-based buffer overflow in the UPnP handling functionality. The vulnerability allows unauthenticated remote attackers to exploit the device if UPnP is enabled. ## Technical Details The issue resides in the `router/upnp/src/ssdp.c` file. An unsafe `strcpy` function is used in the `ssdp_msearch` method, which processes M-SEARCH requests. If an attacker sends a specially crafted request, it can overflow an internal fixed buffer. Although UPnP is disabled by default, enabling it exposes the router to potential exploitation. ## Impact Exploitation of this vulnerability can lead to arbitrary code execution on the affected device. This poses a significant risk, especially if the device is connected to a broader network. The CVSS score of 8.1 indicates a high severity level, underscoring the need for immediate action from users. ## Mitigation To protect against this vulnerability, users should ensure that UPnP is disabled on their DD-WRT routers. Regularly updating to the latest version of DD-WRT is also recommended to mitigate known vulnerabilities. Users should monitor their network for any unusual activity and consider implementing additional security measures to safeguard their devices.