CVE-2024-12986

DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection

View on CVE.org
Published Dec 27, 2024 CVSS 4.0 · 6.9 Medium EPSS 35.5% KEV · Not listed
Description
A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi/apmcfgupptim of the component Web Management Interface. The manipulation of the argument session leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Draytek
Draytek vigor2960
Draytek vigor2960 Firmware
Draytek vigor300b
Draytek vigor300b Firmware
CPEs cpe:2.3:h:draytek:vigor2960:-:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960
Draytek vigor2960 Firmware
Draytek vigor300b
Draytek vigor300b Firmware
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi/apmcfgupptim of the component Web Management Interface. The manipulation of the argument session leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
Title DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 16, 2025, 6:37 PM
Reserved
Dec 27, 2024, 8:03 AM

View source JSON

Updated
Dec 30, 2024, 2:38 PM

JSON

Status
Analyzed
Published
Dec 27, 2024, 4:15 PM
Modified
Jun 17, 2026, 7:00 AM

View source JSON

No data.

No data.