CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Under Active Exploitation (CISA KEV)

What the Vulnerability Is

CVE-2021-27137 is a stack-based buffer overflow (CWE-121) in DD-WRT firmware's web management interface. An attacker with network access to the management interface can send crafted HTTP requests that overflow a stack buffer, potentially resulting in remote code execution or denial of service on the affected router or embedded device.

Affected Software

• Vendor: DD-WRT
• Product: DD-WRT firmware
• Affected versions: Not specified in current intelligence; treat any DD-WRT-managed device exposing the web administration interface as potentially at risk until vendor guidance is confirmed.

Exploitation Status

This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. For defenders, KEV listing means this is not a theoretical risk — organizations with DD-WRT devices, particularly those with internet-facing or otherwise reachable management interfaces, should prioritize detection and remediation immediately.

How Our Detection Catches It

Our coverage targets the exploitation pattern rather than a single request signature, spanning Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the logic looks for:

• Abnormal HTTP requests to DD-WRT management interfaces, including oversized parameters and malformed CGI requests consistent with buffer overflow attempts.
• Unexpected crashes or restarts of the httpd process or other DD-WRT management services, which can indicate a failed or successful overflow trigger.
• Post-exploitation network behavior originating from embedded or IoT network segments, helping catch follow-on activity even if the initial exploit attempt is missed.

Get the Full Detection

View the complete detection logic, including ready-to-deploy queries for all supported SIEM platforms, on the CVE-2021-27137 detection page.