Design/Logic Flaw

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the...

CVE-2008-6975

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...

CVE-2008-6975

CVE-2008-6975: CSRF vulnerabilities in apply.cgi of DD-WRT 24 sp2 allow remote attackers to hijack administrator sessions by manipulating parameters (ping_ip, http_username/http_passwd, remote_management, and port-forward fields from/to/ip/pro). The issue is linked to a reportedly weak anti-CSRF ...

CVE-2008-6974

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the...

CVE-2009-2765

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

CVE-2008-6974

CVE-2008-6974 affects DD-WRT 24 sp1 and earlier. The vulnerability is a CSRF in apply.cgi that allows remote attackers to hijack administrator authentication and issue privileged requests via parameters such as ping_ip (arbitrary command execution), http_username/http_passwd (credential changes),...

CVE-2009-2766

CVE-2009-2766 affects httpd.c in the httpd management GUI of DD-WRT 24 sp1; CGI programs under /cgi-bin/ can be accessed without administrative authentication, enabling remote changes via HTTP requests. CBSS: Network vector, low complexity, no authentication, with partial impact on confidentialit...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

CVE-2009-2765

The CVE-2009-2765 issue affects the DD-WRT HTTPd management GUI, where httpd.c in the HTTP daemon is vulnerable to shell metacharacter injection via requests to a CGI-bin URI. The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands with root privileges on affecte...

PT-2009-5129

Name of the Vulnerable Software and Affected Versions DD-WRT versions prior to build 12533 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a "cgi-bin/" URI. This is due to a problem in the httpd.c in httpd in the management GUI...

DD-WRT (httpd service) Remote Command Execution Vulnerability

No description provided by source. This is a remote root vulnerability in DD-WRT's httpd server. The bug exists at the latest 24 sp1 version of the firmware. The problem is due to many bugs and bad software design decisions. Here is part of httpd.c: 859 if containsstringfile, "cgi-bin" 860 861...

DD-WRT HTTP Daemon Arbitrary Command Execution

This module abuses a metacharacter injection vulnerability in the HTTP management server of wireless gateways running DD-WRT. This flaw allows an unauthenticated attacker to execute arbitrary commands as the root user account. This module requires Metasploit: https://metasploit.com/download Curre...

DD-WRT Remote Root

----------------------------------------------------------------------------------------- A remote root vulnerability in the DD-WRT's httpd service. The bug exists in the latest 24 sp1 version of the firmware. The problem is due to a number of bugs and bad software design decisions. Here is part ...

DD-WRT HTTP v24-SP1 Command Injection Vulnerability

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

DD-WRT HTTP v24-SP1 - Command Injection

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'DD-WRT HTTP...

DD-WRT HTTPd DaemonService - Remote Command Execution

DD-WRT HTTPd DaemonService - Remote Command Execution This is a remote root vulnerability in DD-WRT's httpd server. The bug exists at the latest 24 sp1 version of the firmware. The problem is due to many bugs and bad software design decisions. Here is part of httpd.c: 859 if containsstringfile,...

DD-WRT HTTP v24-SP1 - Command Injection

DD-WRT HTTP v24-SP1 - Command Injection $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

DD-WRT HTTPd Daemon/Service - Remote Command Execution

This is a remote root vulnerability in DD-WRT's httpd server. The bug exists at the latest 24 sp1 version of the firmware. The problem is due to many bugs and bad software design decisions. Here is part of httpd.c: 859 if containsstringfile, "cgi-bin" 860 861 authfail = 0; 862 if !doauth 863...