DD-WRT UPnP Buffer Overflow Vulnerability (CVE-2021-27137) Analysis and POC

Vulnerability Overview A vulnerability in DD-WRT firmware allows unauthorized attackers to trigger a code execution flaw by overflowing an internal buffer via the UPnP protocol. The Common Vulnerabilities and Exposures (CVE) identifier for this issue is CVE-2021-27137. Affected Scope Affected Versions: DD-WRT version 45723 or earlier. Affected Devices: Buffalo devices running DD-WRT firmware. Remediation Vendor Response: The DD-WRT team has confirmed the issue and plans to release a fix as soon as possible. The patched version will be released within a few days, including updates to the router database. Fix Code: The fix code can be viewed at the following link: https://svn.dd-wrt.com/changeset/45724 Vulnerability Analysis UPnP Protocol: UPnP is a network protocol that allows devices to automatically discover each other and establish network connections. By default, the UPnP service in DD-WRT is disabled and listens only on internal network interfaces. Vulnerability Mechanism: The UPnP protocol is inherently unauthenticated, enabling attackers within the local area network (LAN) to trigger a buffer overflow. Specifically, the vulnerability can be triggered by sending an excessively long value. Vulnerable Code: In the file, there is an unbounded copy operation that copies user-provided data into a buffer of 128 bytes. Proof of Concept (POC) Code Summary This vulnerability allows attackers to trigger a buffer overflow in DD-WRT firmware via the UPnP protocol, thereby executing arbitrary code. A fix has been released; affected users are advised to update their firmware as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

DD-WRT UPnP Buffer Overflow Vulnerability (CVE-2021-27137) Analysis and POC