Vendor · Vulnerability hub

DD-WRT vulnerabilities

DD-WRT is an open-source firmware for consumer and SOHO wireless routers, running on hardware from a range of manufacturers. Coverage tracks CVEs against DD-WRT's own daemons — UPnP/SSDP, the httpd web UI, and network services — that reach the CISA KEV catalog or otherwise show up in unpatched-population telemetry.

We track 1 DD-WRT CVE, 1 of them on CISA's Known Exploited Vulnerabilities catalog. The latest KEV addition is CVE-2021-27137, added July 21, 2026.

1 article 1 CVE RSS JSON

CVEs tracked: 1
On CISA KEV: 1
Ransomware use: 0
Rated critical: 0

Latest DD-WRT coverage

Our reporting filed under DD-WRT, plus any story that cites one of its CVEs.

~/articles/2026-07-21-cisa-kev-dd-wrt-cve-2021-27137-upnp-ssdp-strcpy-r45724

dd wrt

DD-WRT UPnP flaw CVE-2021-27137 added to CISA KEV

CISA added DD-WRT's 2021 SSDP-parsing buffer overflow to KEV on 2026-07-21. Unauthenticated attackers can reach it on routers with UPnP left enabled.

Jul 21read →

Known exploited DD-WRT vulnerabilities

CVE / Vulnerability	Severity	CVSS	EPSS	Added to KEV	Patch by
CVE-2021-27137 DD-WRT SSDP Stack-Based Buffer Overflow (UPnP)write-up	[ HIGH ]	8.1	4.0%	Jul 21	Jul 24

Every DD-WRT CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.

Machine-readable: /api/v1/vendors/dd-wrt.json.

Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.