DD-WRT Site Survey SSID Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30573/info DD-WRT is prone to a script-injection vulnerability because it fails to adequately sanitize user-supplied data to the 'Site Survey' section of the administrative web interface. Attackers can exploit this issue ...

DD-WRT v24-sp1 - (CSRF) Cross Site Reference Forgery Exploit

No description provided by source. Remote root dd-wrt -------------------------------------------------------------------------------- Written by Michael Brooks Special thanks to str0ke Exploits tested on the newist stable version: Firmware: DD-WRT v24-sp1 07/27/08 micro Product Homepage:...

DD-WRT Web Management Interface Remote Arbitrary Shell Command Injection Vulnerability

DD-WRT is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2012-6297 - Command Injection via CSRF on DD-WRT v24-sp2

DD-WRT v24-sp2 is prone to command injection from specially crafted configuration values containing shell meta-characters. A remote attacker can potentially use CSRF from an authenticated client to execute commands on the router as the root user. Successful exploitation can result in system wide...

DD-WRT crossite request forgery

Crossite request forgery via web interface...

DD-WRT 24-sp2 CSRF / Command Injection

DD-WRT v24-sp2 is prone to command injection from specially crafted configuration values containing shell meta-characters. A remote attacker can potentially use CSRF from an authenticated client to execute commands on the router as the root user. Successful exploitation can result in system wide...

Buffalo WZR-HP-G300NH2 - Cross-Site Request Forgery

Exploit Title: Buffalo WZR-HP-G300NH2 CSRF Vulnerability Author: Prayas Kulshrestha E-mail: [email protected] Category: Hardware Google Dork: N/A Date: 06/10/2013 Vendor: http://www.buffalotech.com Model: WZR-HP-G300NH2 Firmware Version: DD-WRT v24SP2-MULTI 10/31/11 std - build 17798...

DD-WRT '/Info.live.htm' Multiple Information Disclosure Vulnerabilities

DD-WRT is prone to multiple remote information-disclosure issues because it fails to restrict access to sensitive information. A remote attacker can exploit these issues to obtain sensitive information, possibly aiding in further attacks. OpenVAS Vulnerability Test $Id: gbddwrt45598.nasl 7029...

DD-WRT '/Info.live.htm' Multiple Information Disclosure Vulnerabilities

DD-WRT is prone to multiple remote information-disclosure issues because it fails to restrict access to sensitive information. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

DD-WRT Info.live.htm Information Disclosure

The version of DD-WRT installed on the remote device allows an unauthenticated, remote attacker to retrieve sensitive information about the router itself and any attached hosts, such as geolocation information, IP addresses, MAC addresses and host names, even if remote administration is disabled...

DD-WRT 24-preSP2 - Information Disclosure

DD-WRT 24-preSP2 - Information Disclosure Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a...

DD-WRT 24-preSP2 - Information Disclosure

Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a DD-WRT router and internal clients,...

nat-pmp-info NSE Script

Gets the routers WAN IP using the NAT Port Mapping Protocol NAT-PMP. The NAT-PMP protocol is supported by a broad range of routers including: Apple AirPort Express Apple AirPort Extreme Apple Time Capsule DD-WRT OpenWrt v8.09 or higher, with MiniUPnP daemon pfSense v2.0 Tarifa firmware Linksys...

DD-WRT HTTP Daemon Arbitrary Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'DD-WRT HTTP...

CVE-2008-6975

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...

CVE-2009-2765

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

CVE-2008-6974

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the...

Design/Logic Flaw

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...