Executive brief
DD-WRT, a popular open-source firmware for wireless routers, contains a security flaw in its UPnP (Universal Plug and Play) feature. If UPnP is enabled, an attacker on the local network can send a specially crafted request to take full control of the router. This could lead to the theft of internet traffic, unauthorized access to other devices on the network, or the router being recruited into a botnet.
Technical details
A stack-based buffer overflow exists in router/upnp/src/ssdp.c within the ssdp_msearch function of DD-WRT. The vulnerability is caused by an unsafe strcpy call when handling M-SEARCH requests, allowing an unauthenticated attacker to overflow a fixed-size internal buffer. While UPnP is disabled by default and typically only listens on internal interfaces, enabling it exposes the device to remote code execution. This vulnerability has been observed being exploited in the wild by the 'c0xmo' botnet. The issue is resolved in DD-WRT build 45724.
Affected products
- DD-WRT DD-WRT before 45724
Timeline
- 2021-02-10: disclosed: CVE reserved date
- 2026-07-16: advisory: NVD publication date
- 2026-07-16: exploited: Reports of botnet exploitation (c0xmo) linked to this vulnerability
- 2026-07-16: patched: Fix confirmed in build 45724