Is CVE-2021-27137 (DD-WRT Stack-Based Buffer Overflow) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-27137 to its Known Exploited Vulnerabilities catalogue on 21 July 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

What the KEV listing means for exposure

The practical answer is not just that the flaw exists, but that it has crossed into confirmed exploitation territory. For defenders, that shifts the question from “is this serious?” to “is any internet-facing or broadly reachable DD-WRT instance still exposed?” The right first move is to identify every device or deployment path that could expose the vulnerable UPnP path and treat it as urgent.

When a vulnerability appears in the KEV catalogue, it deserves response prioritisation ahead of routine backlog work. That is especially true for router and edge-device issues, where a single exposed instance can provide a foothold that is hard to monitor and easy to miss during normal asset reviews.

For broader triage and lifecycle handling of actively exploited issues, use the Zero-Day and Exploited Vulnerabilities Guide to align emergency response with KEV-driven prioritisation. For a wider remediation programme, the Vulnerability Management Guide is the better fit for asset scope, prioritisation, and exception handling.

Why this flaw is operationally dangerous

This is a stack-based buffer overflow in a router platform, so the consequence is not limited to a crash. The direct answer states that an unauthenticated attacker can overflow an internal buffer used by UPnP, which means exploitation may occur without credentials and without a legitimate management session. That makes the flaw especially concerning on devices exposed to untrusted networks.

The security significance is the combination of reach and effect: unauthenticated access reduces the attacker effort, while code execution on a networking device can create persistence, traffic interception, configuration tampering, or pivot opportunities. On edge devices, those outcomes often matter more than the initial vulnerability class because the device sits on a trust boundary.

For weakness context, the CWE Top 25 Guide is a useful reference for understanding why buffer overflows remain a high-impact software weakness class, and why memory corruption issues should be treated as execution risks rather than simple stability problems.

What to do if you cannot patch immediately

If remediation must wait, the priority is to reduce exposure, not to assume the issue can be “watched.” Minimise or remove external reachability, restrict administrative access paths, and disable or constrain services that are not operationally required. Because this issue involves UPnP-related behaviour, segmentation and service reduction are more meaningful than passive monitoring alone.

Teams should also assume that exploitation may leave little obvious evidence on the device itself. If the router or edge box has been reachable from untrusted networks, treat it as a potential compromise candidate and review adjacent logs, configuration changes, DNS behaviour, and any downstream systems that depended on it for routing or access control decisions.

For a concrete response model to active exploitation and post-patch hunting, the Zero-Day and Exploited Vulnerabilities Guide gives the most relevant triage pattern, while the Breach and Attack Simulation (BAS) Guide is useful for validating whether defensive controls would have detected or blocked a similar exploitation path.

Risk and Threat Considerations

The main risk is that an attacker can move from network reachability to device-level execution on a system that often sits between users and the internet. That creates a high-leverage compromise point, especially if the device is used for routing, forwarding, DNS handling, or segmentation enforcement.

Failure mechanism: A crafted request can trigger the stack overflow in the UPnP-related buffer handling path, allowing the attacker to drive unintended execution flow and potentially run code without authentication.

Impact: Successful exploitation can lead to device takeover, configuration tampering, traffic interception, persistence, or use of the router as a staging point for additional internal access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Inventory of Assets	Exploited router exposure depends on knowing where DD-WRT devices exist.
	DE.CM-01 — Investigations and Correlates Security Events	Active exploitation requires monitoring for suspicious device and network activity.
Recommendation — Inventory all DD-WRT-capable assets and confirm their exposure paths. Monitor edge-device logs and network signals for signs of exploitation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	KEV-listed exploitation makes timely remediation the core control response.
	AC-4 — Information Flow Enforcement	Isolation and reachability reduction are central when patching must wait.
Recommendation — Prioritise and implement remediation for the vulnerable DD-WRT deployment. Restrict information flows to the device until remediation is complete.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The issue needs prioritisation, verification, and remediation tracking.
Recommendation — Track, prioritise, and remediate the exploited vulnerability across the estate.

Practitioner Guidance

What to verify: Confirm whether the affected DD-WRT build or deployment pattern is present anywhere in the estate, including lab, branch, edge, and forgotten remote units. Do not rely on central inventory alone if field devices can be managed outside normal tooling.

Decision rule: If the device is internet-facing or reachable from untrusted networks, treat patching or replacement as urgent. If patching cannot happen immediately, isolate the device and remove any unnecessary management or service exposure first.

What practitioners underestimate: Edge-device compromise is often a trust-boundary problem, not just a single-host problem. The real question is what downstream network paths, credentials, or routing dependencies the device could expose if it is abused.

Practitioner takeaway: For actively exploited router flaws, the correct unit of response is the exposed device and its network role, not just the CVE record itself.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org