CVE-2008-6974

CVE-2008-6974 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities in DD-WRT firmware versions 24 sp1 and earlier, specifically within the apply.cgi script. An attacker could exploit this to hijack an administrator's authenticated session. This allows for actions such as executing arbitrary commands, changing administrative credentials, enabling remote administration, or configuring port forwarding. The vulnerability has a CVSS score of 6.8, indicating a medium severity. It requires moderate attack complexity (AC:M) but does not require authentication (Au:N), making it remotely exploitable (AV:N). Successful exploitation could lead to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). While not listed on the CISA KEV catalog, exploit code for remote command execution and CSRF has been published on ExploitDB. Despite this, there is no evidence of active exploitation, and community discussion and media coverage are minimal.