I found an exploit for the Linksys WRT54G/S.

http://seclists.org/lists/fulldisclo.../Oct/0329.html <-- discovery
http://seclists.org/lists/fulldisclo.../Oct/0373.html <-- confirmatio=
n