Act now: CISA added CVE-2021-27137 in DD-WRT to its Known Exploited Vulnerabilities catalog on July 21, 2026. The issue affects older DD-WRT builds and is now an urgent maintenance task for anyone operating a router, wireless appliance, lab gateway, or managed network on the platform.
What changed
The vulnerability record identifies DD-WRT builds before 45724 as affected. CISA’s addition means exploitation has been confirmed in the wild. This is not a reason to expose a home, small-business, or managed router administration interface to the public internet; it is a reason to verify the installed build, update through the normal device process, and reduce unnecessary service exposure.
Who should check
- Small businesses, agencies, and remote workers using DD-WRT routers or wireless devices.
- IT teams operating lab, branch, remote-access, or customer-managed network appliances.
- Hosting and managed-service teams that support edge devices or remote offices.
- Anyone who installed DD-WRT years ago and has not reviewed the device build or enabled services since.
Safe remediation plan
- Inventory DD-WRT devices and record the installed build, hardware model, and responsible owner.
- For builds before 45724, move to a current compatible DD-WRT build that includes the vendor fix. Follow the documented process for the device model.
- Keep router administration private. Use a trusted local network, VPN, or approved management path instead of public administration exposure.
- Disable UPnP when it is not needed for a documented application or device requirement, then verify that required services still work.
- After maintenance, confirm normal internet access, wireless connectivity, DHCP or DNS behavior, and any approved remote-management path.
Review older or exposed devices
If a device has been exposed to untrusted networks while affected, review the configuration, administrator accounts, port-forwarding rules, DNS settings, firmware version, and connected-device behavior for unexpected changes. Reset and rotate administration credentials when changes cannot be explained, and remove stale forwarding rules or remote-management exposure. A replacement plan may be safer than forcing a modern feature set onto unsupported router hardware.
Managed-network notes
For an MSP or agency, this is an inventory problem as much as a firmware problem. Identify who owns each device, whether it is still supported, how it is administered, and whether it is reachable from untrusted networks. Communicate the maintenance window before the update, keep a documented recovery path for the specific model, and confirm business-critical connectivity after the work is complete.