Post-authentication Command Injection Vulnerability in DrayTek Vigor3900
CVE-2024-45890

Currently unrated

Key Information:

Vendor
DrayTek
Status
Vigor3900
Vendor
CVE Published:
4 November 2024

Summary

The DrayTek Vigor3900 firmware version 1.5.1.3 is susceptible to a post-authentication command injection vulnerability that exploits the action parameter within the cgi-bin/mainfunction.cgi file when set to download_ovpn. This flaw can allow unauthorized users to execute arbitrary commands on the vulnerable device, potentially compromising its security and operation.

References

https://github.com/N1nEmAn/wp/blob/main/test_v.zip
https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor39...

Timeline

  • Vulnerability published

.