Actively exploited in the wild
DrayTek Vigor Routers OS Command Injection Vulnerability
DrayTek - Vigor Routers · Listed in the CISA KEV since 2025-05-15. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-12987
HighCVSS 7.3KEVSummary
A critical vulnerability in DrayTek Vigor2960 and Vigor300B version 1.5.1.4 in the web management interface. Manipulation of the 'session' argument in /cgi-bin/mainfunction.cgi/apmcfgupload leads to OS command injection.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the device, leading to full control over the router. The exploit is publicly disclosed and may be actively used.
Recommendation
Immediately upgrade DrayTek Vigor2960/Vigor300B firmware to version 1.5.1.5 or later. If upgrading is not possible, restrict access to the management interface.
Other vulnerabilities in DrayTek Vigor
See all- CVE-2024-51138Critical
A stack-based buffer overflow vulnerability has been found in the URL parsing functionality of the TR069 STUN server in DrayTek Vigor routers. Insufficient bounds checking on URL parameters allows a remote attacker to execute arbitrary code with elevated privileges by sending a maliciously crafted request.
- CVE-2020-8515CriticalActively exploited
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
- CVE-2024-41340High
A vulnerability in Draytek Vigor devices allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution. The issue affects multiple models before specific firmware versions.
- CVE-2024-41336High
Draytek Vigor devices store passwords in plaintext. This vulnerability affects multiple models and firmware versions.
- CVE-2024-41335High
Draytek Vigor devices use insecure strcmp and memcmp functions, enabling timing attacks. The vulnerability affects multiple models before specific firmware versions. Attackers can potentially obtain sensitive information by measuring response times.
- CVE-2024-41334High
Draytek Vigor devices do not verify certificates when downloading APPE modules, allowing attackers to upload crafted modules from non-official servers and achieve remote code execution.
Original NVD description (English source)
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.