Authorized RCE Vulnerability in DrayTek Vigor2960 Router
CVE-2024-48074

Currently unrated

Key Information:

Vendor

DrayTek
Status
Vigor2960 Firmware
Vendor
CVE Published:
28 October 2024

What is CVE-2024-48074?

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function.

References

https://github.com/Giles-one/Vigor2960Crack
https://gist.github.com/Giles-one/6425e97dcd1ec97a722a1e2...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-48074 : Authorized RCE Vulnerability in DrayTek Vigor2960 Router