DD-WRT 24/24 SP2/45723 UPnP router/upnp/src/ssdp.c strcpy buffer overflow

Summaryinfo

A vulnerability was found in DD-WRT and classified as very critical. Affected by this issue is the function strcpy of the file router/upnp/src/ssdp.c of the component UPnP Handler. Executing a manipulation can lead to buffer overflow. This vulnerability is registered as CVE-2021-27137. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in DD-WRT. It has been declared as very critical. This vulnerability affects the function strcpy of the file router/upnp/src/ssdp.c of the component UPnP Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).

The advisory is shared for download at svn.dd-wrt.com. This vulnerability was named CVE-2021-27137 since 02/10/2021. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details and also a exploit are known. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/21/2026).

It is declared as attacked. This issue was added on 07/21/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 07/24/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading to version 45724 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2021-34854). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• DD-WRT

Version

• 24
• 24 SP2
• 45723

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion