{"vulnerability": "CVE-2021-27137", "sightings": [{"uuid": "1c1cf615-6580-4be5-9d3e-b5ee02a3e847", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://infosec.exchange/users/VirusBulletin/statuses/116691019017195575", "content": "Vincent Li at FortiGuard Labs analyses C0XMO, a new Gafgyt variant discovered in March 2026 that spreads by exploiting CVE-2021-27137. A key change is the separation of lateral movement into a standalone Python script, helping the botnet target multiple architectures and device types. https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "creation_timestamp": "2026-06-04T09:00:51.199952Z"}, {"uuid": "892f8cd5-f027-4216-a9f4-820c5d13baeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/virusbtn.bsky.social/post/3mnhb5w3wbk2o", "content": "Vincent Li at FortiGuard Labs analyses C0XMO, a new Gafgyt variant that spreads by exploiting CVE-2021-27137. A key change is the separation of lateral movement into a standalone Python script, helping the botnet target multiple architectures and device types. www.fortinet.com/blog/threat-...", "creation_timestamp": "2026-06-04T09:00:52.029145Z"}, {"uuid": "0db5a276-5700-44ef-a0a4-ed1c0f59eb86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mnj5ifvhld2l", "content": "FortiGuard Labs found C0XMO, a modular Gafgyt variant exploiting CVE-2021-27137 on DD-WRT routers, using Python scanning to spread across Linux and IoT devices with persistence and DDoS features. #C0XMO #Gafgyt #DDWRT", "creation_timestamp": "2026-06-05T03:00:26.524345Z"}, {"uuid": "0ff28e04-7384-4ba6-8379-84881a799956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mnpqpkmbya2x", "content": "C0XMO, a modular Gafgyt botnet, targets DD-WRT routers via CVE-2021-27137, brute-forces weak SSH/Telnet logins, and kills rival malware while spreading across many device architectures. #C0XMO #Gafgyt #DDWRT", "creation_timestamp": "2026-06-07T18:00:26.647208Z"}, {"uuid": "220ff201-319d-45fa-b93a-c0d64ec6e6fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-27137", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mnqwigyq2f24", "content": "\ud83d\udcf0 Botnet C0XMO Meluas Lewat Celah DD-WRT: Luncurkan Serangan DDoS dan Basmi Malware Pesaing\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/06/08/botnet-c0xmo-serang-router-dd-wrt-dan-hapus-malware-pesaing/\n\n#botnetC0xmo #cve-2021-27137 #dd-wrt #fortinet #gafgyt #keamananSiber #mal", "creation_timestamp": "2026-06-08T05:16:28.674906Z"}, {"uuid": "f29e11e4-a0a7-443e-8ccd-6f6c5a6968ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "MISP/297905e4-0013-43d5-9bfe-ad728dc8cf58", "content": "", "creation_timestamp": "2026-06-11T10:57:44.000000Z"}, {"uuid": "bab7d94d-69de-4c65-8571-a3025be69b6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrwzmanf62c", "content": "CVE-2021-27137 - DD-WRT UPnP Buffer Overflow\nCVE ID : CVE-2021-27137\n \n Published : July 16, 2026, 6:16 p.m. | 18\u00a0minutes ago\n \n Description : An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows a...", "creation_timestamp": "2026-07-16T19:14:18.987234Z"}, {"uuid": "894ae1ee-226d-40d3-bf27-9f247e5f95ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mr62lvr2v72h", "content": "\ud83d\uded1 CVE-2021-27137\nDD-WRT DD-WRT\nCVSS 8.1 / EPSS 5% / KEV: No\nTL;DR: An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in\u2026\nhttps://cvesentinel.com/report/CVE-2021-27137?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-07-21T14:50:11.019405Z"}, {"uuid": "fe23a167-8dc1-4efe-a801-1f7e99a7fae9", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1b340c4a-eaac-42b6-993b-564939a9e72a", "content": "", "creation_timestamp": "2026-07-21T15:00:01.889225Z"}, {"uuid": "20806e11-1e64-430a-b5b0-0b591f7a2751", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0912e7a5-8931-4840-b5b7-3ea958a72576", "content": "", "creation_timestamp": "2026-07-21T15:00:38.953783Z"}, {"uuid": "7e990f38-6b6e-4381-b108-364459e1ac90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "content": "", "creation_timestamp": "2026-07-21T16:15:02.833114Z"}, {"uuid": "5f772955-3199-479e-8e2d-f0c54a9e4082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mr6akwgum72q", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog\nCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer\u2026\n\n\ud83d\udd17 https://hnow.live/a/6a256aaf", "creation_timestamp": "2026-07-21T16:37:00.571360Z"}, {"uuid": "2bb70070-d375-4b7c-94fd-8499907440fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr7agdtno72s", "content": "\ud83d\udccc CVE-2021-27137 - An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticate... https://www.cyberhub.blog/cves/CVE-2021-27137", "creation_timestamp": "2026-07-22T02:07:06.893277Z"}, {"uuid": "42ebf7f5-fecd-4e44-9d0b-8d3951fe5714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mr7giaghtj24", "content": "\u26a0\ufe0f CRITICAL THREAT: CVE-2021-27137 in DD-WRT allows unauthenticated remote code execution via UPnP. With active exploitation verified, edge defense is critical. Get the forensic detection and hardening strategies you need to secure your infrastructure. #CyberSecurity #InfoSec #DDWRT\u2026", "creation_timestamp": "2026-07-22T03:55:33.338101Z"}, {"uuid": "59278417-b127-438a-8b57-83148b22e2a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mr7joxowrf2g", "content": "DD-WRT Bleeds Out While The Bureaucracy Checks The Fax Tray\nPANIC 82% | Lag 0.0h | DD-WRT is affected by CVE-2021-27137, a stack-based buffer overflow that can allow unauthenticated r\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-22T04:53:00.030868Z"}, {"uuid": "c0bfe1d6-1fa7-43b6-bb17-f2c3dc4c00b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116964653150323533", "content": "\ud83d\udcf0 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress\nCISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s\u2026", "creation_timestamp": "2026-07-22T16:49:32.001199Z"}, {"uuid": "6a64e3b4-36e9-441b-bb81-6d078c1c7d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27137", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mrarr25fd22q", "content": "CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-22T16:49:59.647852Z"}]}