Also, an uploaded file is stored in the same place where the system configurations are kept, which means an attacker could overwrite DNS settings.
"Although it will pop back and say you are not authorized, it will go ahead and write that to the file system anyway," he said.
Adkins said this attack will only work if WAN management is enabled, which allows someone to remotely log into a router and change its settings, he said.
Most users don't need that enabled and should shut it off, he said. But some router manufacturers have incorporated that capability as part of storage services they offer, Adkins said. Some routers have USB ports that allow consumers to plug in a hard drive to it and access content from it remotely.
Many D-Link routers could be affected by all of the flaws. Adkins confirmed D-Link's DIR-820L running firmware versions 1.02B10, 1.05B03 and 2.01b02 are vulnerable. He suspects other models of D-Link routers could be affected, which he lists in his advisory, but he has not tested them.
A router from Trendnet, the TEW-731BR, was also affected, but that vendor has patched, Adkins said.
Sign up for CIO Asia eNewsletters.