Vendor

DD-WRT

DD-WRT is an open-source firmware for consumer and SOHO wireless routers, running on hardware from a range of manufacturers. Coverage tracks CVEs against DD-WRT's own daemons — UPnP/SSDP, the httpd web UI, and network services — that reach the CISA KEV catalog or otherwise show up in unpatched-population telemetry.

CVEs

CVE-2021-27137

[ HIGH ] CVSS 8.1 kev

DD-WRT SSDP Stack-Based Buffer Overflow (UPnP)

An unsafe strcpy in DD-WRT's SSDP handling lets an unauthenticated attacker overflow an internal buffer via the UPnP listener and trigger code execution. Added to CISA KEV on 2026-07-21.

DD-WRT / DD-WRT router firmware (builds prior to revision 45724) Jul 16

Articles

~/articles/2026-07-21-cisa-kev-dd-wrt-cve-2021-27137-upnp-ssdp-strcpy-r45724

● Breaking

dd wrt

DD-WRT UPnP flaw CVE-2021-27137 added to CISA KEV

CISA added DD-WRT's 2021 SSDP-parsing buffer overflow to KEV on 2026-07-21. Unauthenticated attackers can reach it on routers with UPnP left enabled.

Jul 21 read →