DD-WRT

Records8All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

DD-WRT records in CISA KEV

TI-2021-08684 DD-WRT Stack-Based Buffer Overflow Vulnerability CRITICAL 94KEV 2026-07-21

Components

Products in the NVD configurations · select one to filter the records

Dd-wrt 8 records CRITICAL

Records

8 records

TI-2021-08684 CVE-2021-27137 · GHSA-qx3v-2jx6-8m2c

Stack-based buffer overflow in DD-WRT

CRITICAL 94KEV

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.03995 Published 2026-07-16 Fixed in 45724 CWE-121

TI-2022-10612 CVE-2022-27631 · GHSA-hhx7-c9wv-4ggc

Out-of-bounds write in DD-WRT

HIGH 81

A memory corruption vulnerability exists in the httpd unescape functionality of DD-WRT Revision 32270 - Revision 48599.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01186 Published 2022-08-05 No fix listed CWE-787

TI-2009-02631 CVE-2009-2765 · GHSA-p3rr-cvjw-cgxr

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build…

HIGH 77

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.

CVSS 2.0HIGH 8.3 Adjacent network No auth Interaction — EPSS 0.82504 Published 2009-08-14 No fix listed CWE-20

TI-2020-10949 CVE-2020-13976 · GHSA-6cm3-3v62-g64q

An issue was discovered in DD-WRT through 16214.

MEDIUM 44

An issue was discovered in DD-WRT through 16214.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01766 Published 2020-06-09 No fix listed CWE-78

TI-2012-05124 CVE-2012-6297 · GHSA-2r5w-qhv2-w8xr

Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted…

MEDIUM 41

Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01691 Published 2020-02-06 No fix listed CWE-352

TI-2009-02632 CVE-2009-2766 · GHSA-jc49-c4w8-g43h

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative…

MEDIUM 41

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.05129 Published 2009-08-14 No fix listed CWE-264

TI-2008-06663 CVE-2008-6975 · GHSA-96w9-7v87-99v9

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2…

LOW 33

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the ping…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01311 Published 2009-08-14 No fix listed CWE-352

TI-2008-06662 CVE-2008-6974 · GHSA-mxf4-vppx-9gvw

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1…

LOW 33

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01452 Published 2009-08-14 No fix listed CWE-352

Open these records in search →

Critical	1
High	5
Medium	2
Low	0
No CVSS	0