Command Injection Vulnerability in DrayTek Vigor3900
CVE-2024-45888

Currently unrated

Key Information:

Vendor
DrayTek
Status
Vigor3900
Vendor
CVE Published:
4 November 2024

Summary

The DrayTek Vigor3900 running version 1.5.1.3 is susceptible to a command injection vulnerability. This occurs when an attacker manipulates the action parameter within the cgi-bin/mainfunction.cgi interface, specifically when invoking the set_ap_map_config function. Through this flaw, remote attackers may execute arbitrary commands on the affected device, potentially compromising network security and system integrity.

References

https://github.com/N1nEmAn/wp/blob/main/test_v.zip
https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor39...

Timeline

  • Vulnerability published

.