IoT Botnet C0XMO Exploits UPnP Flaw (CVE‑2021‑27137) to Hijack Routers, Kill Competing Malware and Power Massive DDoS Campaigns

IoT Botnet C0XMO Exploits UPnP Flaw (CVE‑2021‑27137) to Hijack Routers, Kill Competing Malware and Power Massive DDoS Campaigns

What It Is — C0XMO is a new variant of the Gafgyt IoT botnet that leverages the long‑standing CVE‑2021‑27137 stack buffer overflow in the UPnP service of DD‑WRT router firmware. It spreads via crafted UDP packets, hijacks a wide range of IoT devices, and actively removes rival malware before launching DDoS attacks.

Exploitability — The vulnerability is publicly known and remains unpatched on many legacy devices. Exploits are observed in the wild; no additional PoC is required beyond the malicious UDP packet. CVSS v3.1 base score is 8.8 (High).

Affected Products — DD‑WRT firmware on routers, DVRs, and other Linux‑based network appliances; any device exposing UPnP/SSDP on port 1900.

TPRM Impact — Compromised third‑party IoT assets can be used to disrupt client operations, tarnish brand reputation, and introduce supply‑chain risk for organizations that rely on these devices for connectivity, edge computing, or remote monitoring.

Recommended Actions —

• Immediately apply firmware updates that address CVE‑2021‑27137 or replace affected devices.
• Disable UPnP/SSDP on all network‑edge equipment.
• Implement network segmentation and outbound traffic monitoring for anomalous UDP/SSDP traffic.
• Deploy host‑based intrusion detection on IoT gateways to detect the C0XMO persistence files and cron jobs.
• Conduct a sweep of existing devices for the hidden /tmp/.sys binaries and remove them.

Source: Security Affairs