The vulnerability resides in the cgiGetFile argument handling of the uploadlangs CGI, enabling an attacker to inject shell commands through the File parameter. This leads to operating‑system command execution, a form of remote code execution that can compromise confidentiality, integrity, and availability of the affected device. The weakness is catalogued as both CWE‑77 (Command Injection) and CWE‑78 (OS Command Injection).

DrayTek Vigor 300B routers running firmware up to version 1.5.1.6 are affected. The device is End‑of‑Life and no longer receives vendor support or security patches. The vulnerability requires authenticated access to the web management interface, though attackers can target devices from outside the local network if the interface is exposed.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation typically requires the attacker to have administrative credentials to access the web interface, but once authenticated, the command injection can be triggered remotely through the uploadlangs endpoint. Because the vendor will not issue a fix, any device with the exposed web interface remains at risk.