DrayTek Vigor 2960 firmware before version 1.5.1.4 contains an OS command injection flaw in the CGI login handler. The vulnerability allows an unauthenticated attacker to inject shell metacharacters into the formpassword field, which is unsanitized and passed to an otp_check.sh script. If exploited, arbitrary commands may be executed with web server privileges, leading to complete compromise of the device. This flaw is a classic input validation weakness identified as CWE-78.

The affected product is the DrayTek Vigor 2960 series network device. Firmware versions earlier than 1.5.1.4 are vulnerable. No other firmware releases or product lines are listed as impacted.

The CVSS score of 9.2 classifies the issue as critical. EPSS data is not available, and the vulnerability has not been recorded in the CISA KEV catalog, implying no currently known exploitation in the wild. However, the attack requires only knowledge of a valid username and that the target account has multi‑factor OTP enabled, which is often common. The bearer leverages the web interface from any network reachable to the device, making the attack vector remote and accessible over standard protocols.