I am worried about the millions (actually, worried about mine) of routers/modems that run Linux. How exposed are they to Shellshock?

3 Answers 3


Most Linux-based routers are running an OpenWRT/DD-WRT derivative. These routers use BusyBox as their shell (Bash is much too heavyweight for the hardware), and consequently are not vulnerable.

  • 1
    Here is a post from pfsense too. "The base system of pfSense does not include bash."
    – Christos
    Sep 26, 2014 at 7:21
  • 2
    Is there a way to test if my own router is vulnerable?
    – CharlesB
    Sep 26, 2014 at 8:18
  • "Most Linux-based routers are running an OpenWRT/DD-WRT derivative." - lolwut? And busybox is not a shell. Sep 28, 2014 at 1:53
  • 3
    @SmitJohnth, busybox is a multi-call binary that encapsulates most of what you need to run a command-line Linux into a single executable. Run it under the name sh or ash, and you get a shell derived from ash.
    – Mark
    Sep 28, 2014 at 2:24
  • 1
    @SmitJohnth, Sort of maybe if you squint at it right.
    – Mark
    Sep 28, 2014 at 4:47

Ubiquiti Routers running EdgeOS have much beefier hardware, and run a derivative of Vayatta on Linux that includes bash. Those are likely vulnerable.



Endian Community Firewall is also currently vulnerable, even though they have already released a patch for their paying customers. Planning on switching to Sophos UTM soon.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .