Post-authentication Command Injection Vulnerability in DrayTek Vigor3900
CVE-2024-45890

Currently unrated

Key Information:

Vendor: DrayTek
Status: Vigor3900
Vendor: CVE Published:; 4 November 2024

What is CVE-2024-45890?

The DrayTek Vigor3900 firmware version 1.5.1.3 is susceptible to a post-authentication command injection vulnerability that exploits the action parameter within the cgi-bin/mainfunction.cgi file when set to download_ovpn. This flaw can allow unauthorized users to execute arbitrary commands on the vulnerable device, potentially compromising its security and operation.

References

https://github.com/N1nEmAn/wp/blob/main/test_v.zip

https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor39...

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 4, 2024