CVE-2009-2765: DD-WRT management GUI httpd command injection via cgi-bin URI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated adjacent-network command execution with public exploit code and very high EPSS, but the attack requires adjacency to the management interface and the product is a consumer router.

What it is

The httpd.c component of the DD-WRT management GUI fails to validate input in requests to cgi-bin/ URIs, allowing shell metacharacters to be passed into command execution. DD-WRT 24 sp1 and versions before build 12533 are affected. Because this is the router's administrative web interface, successful exploitation gives full control of the device.

Impact

An attacker can execute arbitrary commands on the router, gaining full control of the device, its configuration, and any traffic it handles.

Attack surface

Reached over the network via HTTP requests to the management GUI's cgi-bin/ URIs; the CVSS vector AV:A indicates the attacker must be on the adjacent network, and Au:N indicates no authentication is required. No user interaction is described.

Exploitation

Public exploit code exists (Metasploit module and Exploit-DB entry), and EPSS is 0.82504 (99.6th percentile), though CISA KEV does not list it.

What to do

• Upgrade DD-WRT to build 12533 or later, which fixes the flaw.
• If upgrade is not possible, disable remote management and restrict the management GUI to trusted internal hosts only.
• Segment or firewall the router's management interface so it is not reachable from untrusted adjacent networks.
• Replace end-of-life DD-WRT builds with a supported firmware release.

Detection

• Inspect HTTP request logs for cgi-bin/ URIs containing shell metacharacters such as ;, |, $, or backticks.
• Monitor router processes for unexpected child shells or commands spawned by httpd.
• Alert on management GUI access from hosts outside the expected administrative network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.