漏洞描述
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.osvdb.orghttp://www.osvdb.org/55990↗www.dd-wrt.comhttp://www.dd-wrt.com/phpBB2/viewtopic.php?t=55173↗www.theregister.co.ukhttp://www.theregister.co.uk/2009/07/21/critical_ddwrt_router_vuln/↗www.dd-wrt.comhttp://www.dd-wrt.com/↗securitytracker.comhttp://securitytracker.com/id?1022596↗isc.sans.orghttp://isc.sans.org/diary.html?storyid=6853↗www.securityfocus.comhttp://www.securityfocus.com/bid/35742↗