CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability
Status: confirmed exploited in the wild
CVE-2021-27137 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-07-21. Inclusion in KEV is not a severity prediction. It means CISA has reliable evidence that the vulnerability has actually been exploited against real targets, which is a stronger signal than a CVSS score on its own.
| Field | Value |
|---|---|
| CVE | CVE-2021-27137 |
| Vendor | DD-WRT |
| Product | DD-WRT |
| Added to KEV | 2026-07-21 |
| Federal due date | 2026-07-24 |
| Ransomware campaign use | Unknown |
What the vulnerability is
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
Weakness classification
CISA classifies this entry under:
Required action
CISA's stated required action for this entry:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware context
CISA lists ransomware campaign use for this entry as "Unknown". That is an absence of confirmation rather than evidence it has not been used, so it should not be read as lowering priority.
Federal remediation deadline
Under CISA Binding Operational Directive 22-01, U.S. federal civilian executive branch agencies were required to remediate this vulnerability by 2026-07-24. The directive does not bind private organisations, but the due date is a useful external signal: CISA sets shorter windows for what it assesses as higher risk.
Why KEV membership changes prioritisation
Most vulnerability backlogs are too large to clear, so the practical question is ordering rather than coverage. KEV is useful for that because it is evidence-based: an entry is on the list because exploitation was observed, not because a scoring formula predicted it might be.
A defensible triage rule used widely is to treat KEV membership as a promotion signal that overrides CVSS ranking, on the basis that a confirmed-exploited medium-severity issue generally warrants attention ahead of a theoretical critical one.
Determining whether you are affected
- Establish whether DD-WRT DD-WRT is present anywhere in your estate, including indirectly and in systems not under active management.
- Identify the deployed versions and compare against the vendor advisory linked below.
- Apply the required action above, then confirm the change took effect rather than assuming it did.
Step one is where this usually fails. Several of the most costly incidents on record, including Code Red and Log4Shell, turned on organisations being unable to answer whether affected software was present at all.
How Safeguard helps
Safeguard's vulnerability management enriches findings with KEV and EPSS data, so an entry like this one surfaces as confirmed-exploited rather than sitting undifferentiated in a ranked list.
Sources
- CISA KEV catalog (version 2026.09.16): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD record for CVE-2021-27137: https://nvd.nist.gov/vuln/detail/CVE-2021-27137
- Vendor and advisory references: https://svn.dd-wrt.com/changeset/45724 , https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk , https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk , https://nvd.nist.gov/vuln/detail/CVE-2021-27137
Catalog data retrieved from CISA KEV version 2026.09.16. Verify against the live catalog before relying on dates for compliance purposes.
