DD-WRT records

8 published records for vendor dd-wrt.

Researcher profile

Entered KEV: 1 · 12.5%
Weaponized: 2 · 25%
Pre-auth RCE: 4
With a fix record: 0%
Median publish → KEV: 5 days

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
63This week	CVE-2021-27137Weaponized	An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.dd-wrt · dd-wrt · CWE-121 Pre-auth Memory safety	High8.1	KEV	3.9%	Jul 16, 2026
58Plan	CVE-2009-2765Weaponized	httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrarydd-wrt · dd-wrt · CWE-20 RCE	High8.3	—	82.5%	Aug 14, 2009
39Monitor	CVE-2022-27631No exploit	A memory corruption vulnerability exists in the httpd unescape functionality of DD-WRT Revision 32270 - Revision 48599.dd-wrt · dd-wrt · CWE-787 Pre-auth Memory safety	Critical9.8	—	1.1%	Aug 5, 2022
36Monitor	CVE-2020-13976No exploit	An issue was discovered in DD-WRT through 16214.dd-wrt · dd-wrt · CWE-78 pre-auth RCE Command injection CSRF	High8.8	—	1.7%	Jun 9, 2020
36Monitor	CVE-2012-6297No exploit	Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-charactdd-wrt · dd-wrt · CWE-352 pre-auth RCE Command injection CSRF	High8.8	—	1.6%	Feb 6, 2020
32Monitor	CVE-2009-2766Proof of concept	httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which aldd-wrt · dd-wrt · CWE-264 Pre-auth	High7.5	—	5.1%	Aug 14, 2009
27Monitor	CVE-2008-6974Proof of concept	Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the audd-wrt · dd-wrt · CWE-352 pre-auth RCE CSRF	Medium6.8	—	1.4%	Aug 14, 2009
27Monitor	CVE-2008-6975Proof of concept	Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authenticationdd-wrt · dd-wrt · CWE-352 pre-auth RCE CSRF	Medium6.8	—	1.3%	Aug 14, 2009

CVE-2021-27137
63This week
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.
HighCVSS 8.1KEVWeaponizedEPSS 3%
- Pre-auth
- Memory safety
dd-wrt · dd-wrtJul 16, 2026
CVE-2009-2765
58Plan
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary
HighCVSS 8.3WeaponizedEPSS 82%
- RCE
dd-wrt · dd-wrtAug 14, 2009
CVE-2022-27631
39Monitor
A memory corruption vulnerability exists in the httpd unescape functionality of DD-WRT Revision 32270 - Revision 48599.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Memory safety
dd-wrt · dd-wrtAug 5, 2022
CVE-2020-13976
36Monitor
An issue was discovered in DD-WRT through 16214.
HighCVSS 8.8No exploitEPSS 1%
dd-wrt · dd-wrtJun 9, 2020
CVE-2012-6297
36Monitor
Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-charact
HighCVSS 8.8No exploitEPSS 1%
dd-wrt · dd-wrtFeb 6, 2020
CVE-2009-2766
32Monitor
httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which al
HighCVSS 7.5Proof of conceptEPSS 5%
- Pre-auth
dd-wrt · dd-wrtAug 14, 2009
CVE-2008-6974
27Monitor
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the au
MediumCVSS 6.8Proof of conceptEPSS 1%
- pre-auth RCE
- CSRF
dd-wrt · dd-wrtAug 14, 2009
CVE-2008-6975
27Monitor
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication
MediumCVSS 6.8Proof of conceptEPSS 1%
- pre-auth RCE
- CSRF
dd-wrt · dd-wrtAug 14, 2009