DrayTek · Vigor Routers
CVE-2024-12987
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
这是什么
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
CISA: DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
该怎么做
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
美国联邦机构的修复期限：2025年6月5日
DrayTek 的其他被利用漏洞
| 加入日期 | 漏洞 | 产品 | 严重程度 | 受攻击概率 |
|---|---|---|---|---|
| 2024年9月30日 | OS Command Injection | Multiple Vigor Routers | 严重 9.8 | 84% |
| 2024年9月3日 | Path Traversal Vulnerability | VigorConnect | 高 7.5 | 90% |
| 2024年9月3日 | Path Traversal Vulnerability | VigorConnect | 高 7.5 | 96% |
| 2021年11月3日 | Multiple DrayTek Vigor Routers Web Management Page | Multiple Vigor Routers | 严重 9.8 | >99.9% |
来源：Known Exploited Vulnerabilities（CISA，公有领域）、CVE records（cve.org）和 EPSS（FIRST）。受攻击概率是 EPSS 对未来 30 天内有人尝试利用该漏洞的估计。