Command Injection Vulnerability in DrayTek Vigor2960

CVE-2023-24229

Summary

The DrayTek Vigor2960, specifically version v1.5.1.4, is susceptible to a command injection vulnerability that allows authenticated attackers with network access to exploit the web management interface. Through the manipulation of the 'parameter' parameter in the mainfunction.cgi script, an attacker can inject operating system commands, potentially compromising the device's integrity. It's important to note that this vulnerability is limited to devices that have reached their end-of-life and are no longer supported by the vendor.

References