Technical impact
A flaw in the sub_14914 routine of /cgi-bin/mainfunction.cgi enables an attacker to inject and execute arbitrary commands through the swmconfigupload parameter. The vulnerability is a command injection that can compromise confidentiality and integrity of the device if exploited. It does not, however, lead to denial of service or data loss on its own. This attack requires that the attacker can send crafted requests to the router, which they can do remotely if the router is reachable from the outside.
Affected Systems
The problem affects DrayTek Vigor2960 units running firmware versions up to 1.5.1.6. The vendor’s security advisory indicates that firmware 1.5.1.7 includes the necessary fix. Devices still on earlier releases are vulnerable and need to be upgraded or otherwise protected.
Risk and Exploitability
The flaw carries a CVSS score of 9.4, indicating a critical severity. The exploit is publicly disclosed and can be executed from outside the network, making it highly actionable. EPSS data is not available, but the lack of a KEV listing does not diminish the urgency because the weakness is independent. The attack vector is remote, and given the high score and availability of an exploit, the risk remains acute until a patch is applied.
