DD-WRT Web Management Interface Remote Arbitrary Shell Command Injection Vulnerability

  1. Network Vulnerabilities
  2. Web application abuses
  3. DD-WRT Web Management Interface Remote Arbitrary Shell Command Injection Vulnerability
Summary
DD-WRT is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.
Impact
Remote attackers can exploit this issue to execute arbitrary shell commands with superuser privileges, which may facilitate a complete compromise of the affected device.
Solution
Vendor fixes are available.
Insight
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI
Affected
DD-WRT v24-sp1 is affected other versions may also be vulnerable.
Detection
Try to execute the 'id' command via HTTP GET request.
References
Updated on 2015-03-25
Severity
High Severity
Classification
Related Vulnerabilities