Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2021-27137.
Upgrade to ProDetect DD-WRT Stack-Based Buffer Overflow Exploitation Attempt (CVE-2021-27137) in Google Chronicle
Detects exploitation attempts against a stack-based buffer overflow vulnerability (CWE-121) in DD-WRT firmware. The flaw allows an attacker with network access to the DD-WRT web management interface to trigger a stack overflow via crafted HTTP requests, potentially leading to remote code execution or denial of service on the router/embedded device. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Detection focuses on abnormal HTTP requests to DD-WRT management interfaces (oversized parameters, malformed CGI requests), unexpected crash/restart of httpd or DD-WRT management processes, and post-exploitation network behavior originating from embedded/IoT network segments.
MITRE ATT&CK
- Tactic
- Initial Access Impact Execution
YARA-L Detection Query
rule dd_wrt_cgi_buffer_overflow_attempt {
meta:
author = "df00tech"
description = "Detects oversized or encoded requests to DD-WRT CGI management endpoints (CVE-2021-27137)"
severity = "HIGH"
cve = "CVE-2021-27137"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.target.port = 80 or $e.target.port = 443 or $e.target.port = 8080
$e.network.http.method = "GET" or $e.network.http.method = "POST"
(re.regex($e.target.url, `(?i)(cgi-bin|apply\.cgi|management\.asp)`))
(strings.length($e.target.url) > 2000 or re.regex($e.target.url, `(%[0-9A-Fa-f]{2}){100,}`))
match:
$e.principal.ip over 5m
condition:
$e and #e >= 3
}Chronicle YARA-L rule detecting repeated oversized or hex-encoded HTTP requests to DD-WRT CGI management endpoints, indicative of stack-based buffer overflow exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate device management automation with long query strings
- Authorized penetration test traffic
- Proxy log truncation/encoding artifacts inflating URL length
Other platforms for CVE-2021-27137
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized CGI Parameter Request
Expected signal: Firewall/proxy log entry showing a GET request to /apply.cgi with a URI length exceeding 2000 characters from the test source IP.
- Test 2Hex-Encoded Payload Simulation
Expected signal: Web/proxy log capturing a request URI containing repeated %41-style percent-encoded sequences exceeding 100 occurrences.
- Test 3Repeated Burst Requests to Management Interface
Expected signal: Four distinct oversized HTTP requests to /cgi-bin/config.exe logged from the same source IP within a 5-minute window.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2021-27137 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month