CVE-2008-6974 Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) execute...
MediumCVSS 6.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the ping_ip parameter; (2) change the administrative credentials via the http_username and http_passwd parameters; (3) enable remote administration via the remote_management parameter; or (4) configure port forwarding via certain from, to, ip, and pro parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dd-wrt | <= 24 | No fix listed |
References
- www.dd-wrt.com exploit vendor-advisory
- 20081208 Multiple XSRF in DD-WRT (Remote Root Command Execution) mailing-list
- 20081210 Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) mailing-list
- 20081211 Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) mailing-list
- 20081211 Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) mailing-list
- 9209 exploit