Vulnerability in DrayTek Vigor3900 Discovered
CVE-2024-44844

8.8HIGH

Key Information:

Vendor

DrayTek
Status
Vigor3900 Firmware
Vendor
CVE Published:
6 September 2024

What is CVE-2024-44844?

An authenticated command injection vulnerability in DrayTek Vigor3900, version 1.5.1.6, allows an authenticated attacker to execute arbitrary commands on the system through improper handling of the name parameter in the run_command function. This security flaw could be exploited to manipulate the device's functionality, leading to unauthorized actions within the network.

References

https://github.com/3okfc/IOT-VUL-WP/blob/main/DaryTek/vig...

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.