{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alangflowlangflow1.4.2-/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2021-27137"},{"cvss":9.8,"id":"CVE-2026-0770"},{"cvss":9.8,"id":"CVE-2026-63030"},{"cvss":5.9,"id":"CVE-2026-60137"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DD-WRT","Langflow","WordPress Core"],"_cs_severities":["critical"],"_cs_tags":["vulnerability-exploitation","firmware","router","rce","buffer-overflow"],"_cs_type":"threat","_cs_vendors":["DD-WRT","Langflow","WordPress"],"content_html":"\u003cp\u003eCVE-2021-27137 identifies a critical stack-based buffer overflow vulnerability within the UPnP service of DD-WRT firmware, potentially allowing unauthenticated remote code execution. This flaw enables attackers to overflow an internal buffer by sending specially crafted network packets, leading to the execution of arbitrary code on vulnerable DD-WRT devices. The vulnerability, first disclosed in 2021, has been added to CISA's Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild. Given DD-WRT's widespread use in consumer and small business networking equipment, successful exploitation can lead to full compromise of the router, potentially enabling network surveillance, traffic redirection, or further access to internal networks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a DD-WRT device with the vulnerable UPnP service exposed.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts and sends specially malformed network packets to the UPnP service listening on the target DD-WRT device.\u003c/li\u003e\n\u003cli\u003eThe malformed packets are designed to exceed the bounds of an internal stack buffer within the UPnP service's processing routine.\u003c/li\u003e\n\u003cli\u003eThis crafted input triggers a stack-based buffer overflow condition in the UPnP service.\u003c/li\u003e\n\u003cli\u003eThe overflow corrupts memory, including critical return addresses on the stack.\u003c/li\u003e\n\u003cli\u003eThe attacker's injected shellcode, included in the crafted packets, gains control of the execution flow.\u003c/li\u003e\n\u003cli\u003eThe shellcode is executed in the context of the UPnP service, achieving unauthenticated remote code execution on the DD-WRT device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2021-27137 grants unauthenticated remote code execution capabilities on vulnerable DD-WRT firmware devices. This allows an attacker to gain full control over the router, potentially leading to unauthorized access to the network, manipulation of network traffic, or establishment of persistent footholds. Given that DD-WRT is deployed in various environments, including homes and small businesses, the impact can range from personal data breaches to compromise of organizational networks. CISA's inclusion of this CVE in its KEV catalog indicates that this vulnerability has been actively exploited by threat actors, posing a significant and immediate risk to affected organizations and individuals.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply available vendor mitigations for CVE-2021-27137 as documented by DD-WRT and other vendors utilizing affected components.\u003c/li\u003e\n\u003cli\u003eIf mitigations for CVE-2021-27137 are unavailable, discontinue use of the affected product immediately.\u003c/li\u003e\n\u003cli\u003eEnsure compliance with CISA’s BOD 26-04 guidance regarding prioritizing security updates based on risk, especially for internet-facing DD-WRT devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T15:38:20Z","date_published":"2026-07-21T15:00:30Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ddwrt-cve-2021-27137/","summary":"CVE-2021-27137 is a stack-based buffer overflow vulnerability in DD-WRT's UPnP component that allows an unauthenticated attacker to trigger remote code execution on affected router devices.","title":"DD-WRT Stack-Based Buffer Overflow Vulnerability (CVE-2021-27137)","url":"https://feed.craftedsignal.io/briefs/2026-07-ddwrt-cve-2021-27137/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-0770"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["langflow 1.3.0","langflow 1.2.0","Langflow \u003c v1.9.0"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","webapps","langflow"],"_cs_type":"advisory","_cs_vendors":["langflow"],"content_html":"\u003cp\u003eA remote code execution (RCE) vulnerability exists in Langflow version 1.3.0, tracked as CVE-2026-0770. This flaw stems from the inclusion of functionality from an untrusted control sphere within the \u003ccode\u003eexec_globals\u003c/code\u003e parameter located at the \u003ccode\u003e/api/v1/validate/code\u003c/code\u003e endpoint. The vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges on affected systems. Exploit-DB has published a working exploit (EDB-52597) for this vulnerability, which exacerbates the risk for organizations using unpatched instances of Langflow. Version 1.2.0 is also affected.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker sends an HTTP GET request to \u003ccode\u003e/api/v1/auto_login\u003c/code\u003e to obtain an access token.\u003c/li\u003e\n\u003cli\u003eThe server responds with a JSON object containing an \u003ccode\u003eaccess_token\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request to \u003ccode\u003e/api/v1/validate/code\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker sets the \u003ccode\u003eAuthorization\u003c/code\u003e header with a \u003ccode\u003eBearare {access_token}\u003c/code\u003e string.\u003c/li\u003e\n\u003cli\u003eThe request body contains a JSON object with a \u003ccode\u003ecode\u003c/code\u003e parameter. This \u003ccode\u003ecode\u003c/code\u003e parameter contains a Python script that leverages the \u003ccode\u003esubprocess\u003c/code\u003e module to execute arbitrary commands.\u003c/li\u003e\n\u003cli\u003eThe Python script within the \u003ccode\u003ecode\u003c/code\u003e parameter utilizes \u003ccode\u003e__import__('subprocess').run('%s', shell=True, capture_output=True, text=True)\u003c/code\u003e to execute the attacker-controlled command.\u003c/li\u003e\n\u003cli\u003eThe server executes the attacker-supplied command with root privileges.\u003c/li\u003e\n\u003cli\u003eThe output of the command is returned to the attacker via the API response, confirming code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code with root privileges on the Langflow server. This can lead to complete system compromise, data theft, denial of service, or further lateral movement within the network. Given the nature of Langflow as a low-code framework designed for building flows with Large Language Models, such a compromise could lead to the exposure of sensitive LLM configurations, API keys, and data used within these flows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch or upgrade to a secure version of Langflow to remediate CVE-2026-0770.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Langflow RCE via Validate Endpoint\u003c/code\u003e to detect exploitation attempts in web server logs.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for unusual POST requests to the \u003ccode\u003e/api/v1/validate/code\u003c/code\u003e endpoint containing shell metacharacters in the \u003ccode\u003ecode\u003c/code\u003e parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T15:00:09Z","date_published":"2026-05-29T08:21:41Z","id":"https://feed.craftedsignal.io/briefs/2026-05-langflow-rce/","summary":"Langflow 1.3.0 contains a remote code execution vulnerability (CVE-2026-0770) due to untrusted input in the exec_globals parameter at the validate endpoint, allowing remote attackers to execute arbitrary code as root without authentication, as demonstrated by a public exploit.","title":"Langflow 1.3.0 Remote Code Execution Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-langflow-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}