The management interface of the current stable version of DD-WRT, the free router firmware, suffers a vulnerability that lets attackers run programs with root rights on the router. The vulnerability, described at milw0rm and in the DD-WRT forum, is caused by inadequate handling of meta-characters in the query string in DD-WRT's httpd web server. The server will then run programs even when no session is running.
Furthermore, the management interface runs with maximum rights. That means attackers can input a URL such as ";command_to_execute" to run commands existing on the system, or take control by running programs with root rights on the equipment. Although by default the DD-WRT web interface can only be reached via the LAN interfaces, this limitation can easily be circumvented, for example with a CSRF (Cross-Site Request Forgery) attack, especially as the vulnerability requires no authentication on the web server. A manipulated IMG tag in a forum would be enough to put a router under an attacker

The link for this article located at H Security is no longer available.