CISA lists DD-WRT UPnP RCE as exploited with July 24 deadline

CISA added CVE-2021-27137 to the Known Exploited Vulnerabilities catalog on July 21, 2026, giving covered U.S. federal agencies until July 24 to apply mitigations or discontinue use where fixes are unavailable. The issue affects DD-WRT firmware and centers on a UPnP buffer overflow that can lead to code execution.

This is not a fresh bug. The operational change is that CISA now treats it as actively exploited, and recent threat research connects the flaw to C0XMO, a Gafgyt botnet variant that targets DD-WRT routers before spreading across other Linux-based device architectures.

DD-WRT's UPnP flaw is back as an active-exploitation item

CVE-2021-27137 is a stack-based buffer overflow in DD-WRT's UPnP handling. CISA's KEV entry says an unauthenticated attacker can overflow an internal buffer used by UPnP and trigger code execution. The agency lists DD-WRT as both vendor and product, sets the date added to July 21, and assigns a July 24 remediation due date under its risk-prioritized patching directive.

Tenable's CVE entry describes the vulnerable path more narrowly: DD-WRT before changeset 45724 can mishandle UPnP SSDP M-SEARCH traffic through ssdp_msearch. Tenable also notes an important exposure qualifier: UPnP is off by default and normally listens only on internal interfaces by default. That does not remove the risk for networks where UPnP was enabled, inherited through older builds, or exposed by weak segmentation.

C0XMO turns router compromise into broader scanning

FortiGuard Labs reported in June that C0XMO, a newer Gafgyt variant, was spreading by exploiting CVE-2021-27137. The report says the malware separates scanning and propagation into a Python-based component, targets multiple CPU architectures, brute-forces Telnet and SSH, and includes DDoS attack functions.

That context matters because router firmware bugs can sit below normal endpoint visibility. A compromised DD-WRT device may not show up in the same telemetry as servers and laptops, yet it can scan internal ranges, attack other exposed services, and persist through small embedded Linux environments that rarely receive the same patch discipline.

What operators should check before July 24

Start with inventory. Find DD-WRT devices, Buffalo devices or other hardware running DD-WRT-derived firmware, lab routers, travel routers, and older access points that may not be in the main asset database. Check whether the installed build is before the referenced DD-WRT fix and whether UPnP is enabled.

For exposed or high-trust network positions, do more than update firmware. Disable UPnP unless it is required, restrict router administration to trusted management networks, block unnecessary inbound discovery traffic between segments, and review outbound connections from router-adjacent networks. If a device is too old to receive maintained firmware, replacement is a cleaner control than carrying a known exploited edge device.

Incident review should include signs of unusual scanning, unexpected Telnet or SSH attempts, unfamiliar binaries or scripts on embedded systems, unexplained cron persistence, and DDoS-related outbound traffic. Fortinet's report includes detailed campaign indicators, but teams should treat those as starting points rather than complete detection coverage.

Evidence

CISA is the primary source for the active-exploitation signal, KEV placement, and July 24 remediation deadline. Tenable and SSD Secure Disclosure corroborate the DD-WRT UPnP vulnerability details, affected pre-fix builds, and the UPnP exposure conditions. FortiGuard Labs provides independent threat context tying CVE-2021-27137 exploitation to the C0XMO botnet campaign.