Command Injection Vulnerability in DrayTek Vigor3900 Router
CVE-2024-45891

Currently unrated

Key Information:

Vendor
DrayTek
Status
Vigor3900
Vendor
CVE Published:
4 November 2024

Summary

A post-authentication command injection vulnerability exists in DrayTek Vigor3900 version 1.5.1.3. This security flaw is triggered when the 'action' parameter is improperly handled in the 'cgi-bin/mainfunction.cgi' script, specifically when it is set to 'delete_wlan_profile.' An attacker could exploit this flaw to execute arbitrary commands on the affected system, potentially leading to unauthorized access and control over the device.

References

https://github.com/N1nEmAn/wp/blob/main/test_v.zip
https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor39...

Timeline

  • Vulnerability published

.