Unrated severityNVD Advisory· Published Aug 14, 2009· Updated Jun 16, 2026

CVE-2009-2765

Description

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dd Wrt/Dd Wrt2 versions
cpe:2.3:a:dd-wrt:dd-wrt:*:sp1:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dd-wrt:dd-wrt:*:sp1:*:*:*:*:*:*range: <=24
- (no CPE)range: 24 sp1, before build 12533

Patches

Vulnerability mechanics

References

isc.sans.org/diary.htmlnvdPatch
www.dd-wrt.comnvdPatchVendor Advisory
metasploit.com/svn/framework3/trunk/modules/exploits/linux/http/ddwrt_cgibin_exec.rbnvdExploit
www.dd-wrt.com/phpBB2/viewtopic.phpnvdExploit
www.securityfocus.com/bid/35742nvdExploit
securitytracker.com/idnvd
www.exploit-db.com/exploits/9209nvd
www.osvdb.org/55990nvd
www.theregister.co.uk/2009/07/21/critical_ddwrt_router_vuln/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.066
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000