CVE-2012-6297 Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial....
HighCVSS 8.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dd-wrt | = 24-sp2 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- vuldb.com permissions-required
- [CVE-2012-6297] DD-WRT v24-sp2 Command Injection mailing-list third-party-advisory
- CVE-2012-6297 - Command Injection via CSRF on DD-WRT v24-sp2 mailing-list third-party-advisory