Vulnerability in Dd-Wrt

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests.

EPSS: 0.051 (91.5th percentile) — read the EPSS interpretation.

Affected products

  • Dd-wrt — versions 24
  • N/a — versions n/a

Weakness classification (CWE)

References