CVE-2009-2765

Published: Aug 14, 2009Modified: Apr 23, 2026

8.3

Vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 6.5 / Impact: 10.0

Source: NVD

Description

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.

Affected (1)

Products: Dd Wrt: Dd Wrt

Dd Wrt

1 product

Dd Wrt

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dd Wrt Dd Wrt	Up to 24

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://isc.sans.org/diary.html?storyid=6853

Source: cve@mitre.org

Patch

http://metasploit.com/svn/framework3/trunk/modules/exploits/linux/http/ddwrt_cgibin_exec.rb

Source: cve@mitre.org

Exploit

http://securitytracker.com/id?1022596

Source: cve@mitre.org

http://www.dd-wrt.com/

Source: cve@mitre.org

PatchVendor Advisory

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=55173

Source: cve@mitre.org

Exploit

http://www.exploit-db.com/exploits/9209

Source: cve@mitre.org

http://www.osvdb.org/55990

Source: cve@mitre.org

http://www.securityfocus.com/bid/35742

Source: cve@mitre.org

Exploit

http://www.theregister.co.uk/2009/07/21/critical_ddwrt_router_vuln/

Source: cve@mitre.org

http://isc.sans.org/diary.html?storyid=6853