CVE-2008-6975 - CVE House
Back to Database
Status published Medium CVE-2008-6975

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT...

Vulnerability Description

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the ping_ip parameter; (2) change the administrative credentials via the http_username and http_passwd parameters; (3) enable remote administration via the remote_management parameter; or (4) configure port forwarding via certain from, to, ip, and pro parameters. NOTE: This issue reportedly exists because of a "weak ... anti-CSRF fix" implemented in 24 sp2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-6975

Credits & Attribution

No credits recorded in the NVD database.

References

More from dd-wrt

View All →
CVE-2020-13976
An issue was discovered in DD-WRT through 16214. The Diagnostic...
High 8.8
CVE-2012-6297
Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2...
High 8.8
CVE-2009-2766
httpd.c in httpd in the management GUI in DD-WRT 24...
High 7.5
CVE-2009-2765
httpd.c in httpd in the management GUI in DD-WRT 24...
High 8.3
CVE-2008-6974
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT...
Medium 6.8

Affected Vendor

Affected Software

dd-wrt
Vulnerable Versions:
24

Timeline

Official Publish: August 14th, 2009
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.