Slashdot Mirror

← Back to Stories (view on slashdot.org)

Critical Flaw Discovered In DD-WRT

Posted by kdawson on from the my-router-my-self dept.

MagicM writes "A critical flaw has been discovered in DD-WRT, a Linux based alternative open source firmware for WLAN routers such as the fan-favorite Linksys WRT54GL. The flaw can give an attacker instant root access to the router merely by embedding an image with a specially crafted URL in a Web page (CSRF attack)." The linked page notes that a fix is being rolled out (build 12533) and gives firewall rules to thwart the attack if the fix is not available yet for a particular device.

4 of 225 comments (clear)

  1. Re:Standard Practices by gamefreak1450 · · Score: 5, Informative

    Basically, I would NEVER allow remote web management of a device if it's on the internet.

    Good idea, but this is a critical exploit because hackers can make an img tag load the malformed URL. If they can trick you into viewing that image, then your router will be compromised from your computer on the network. Disabling the external management will prevent internet users from compromising your router, but it is still vulnerable to local threats, as executed through the CSRF method.

  2. DD-WRT !GPL Compliant (or open source) by Anonymous Coward · · Score: 5, Informative

    DD-WRT just isn't compliant with the GPL on so many levels.calling it an "open source" firmware is a lie and a disgrace to the open source community.

    The open source parts are OpenWRT.

    1. Re:DD-WRT !GPL Compliant (or open source) by Anonymous Coward · · Score: 5, Informative

      DD-WRT is Harmful to open source

  3. Re:This is a common stack in wifi APs by Anonymous Coward · · Score: 5, Informative

    3. Homogeny? Huh?! Do you mean the homogeny that's defined has "a significant portion of huge nerds (though certainly not even close to a majority) uses this software" ? How many routers are being used in homes and small businesses around the world? You think enough of them are running DD-WRT to call it a homogeny? Name a router that you think has more instances of DD-WRT installed than the factory firmware.

    WRT54GL

    http://www.linksysbycisco.com/US/en/products/WRT54GL