DrayTek · Vigor Routers
CVE-2024-12987
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
Что это
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
CISA: DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
Что делать
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Срок для федеральных ведомств США: 5 июня 2025 г.
Другие эксплуатируемые уязвимости DrayTek
| Добавлено | Уязвимость | Продукт | Серьёзность | Вероятность атаки |
|---|---|---|---|---|
| 30 сент. 2024 г. | OS Command Injection | Multiple Vigor Routers | Критическая 9,8 | 84% |
| 3 сент. 2024 г. | Path Traversal Vulnerability | VigorConnect | Высокий 7,5 | 90% |
| 3 сент. 2024 г. | Path Traversal Vulnerability | VigorConnect | Высокий 7,5 | 96% |
| 3 нояб. 2021 г. | Multiple DrayTek Vigor Routers Web Management Page | Multiple Vigor Routers | Критическая 9,8 | >99,9% |
Источники: Known Exploited Vulnerabilities (CISA, общественное достояние), CVE records (cve.org) и EPSS (FIRST). Вероятность атаки — оценка EPSS того, что кто-то попытается использовать уязвимость в ближайшие 30 дней.