PT-2023-9802 · Draytek · Draytek Vigor2960

CVE-2023-24229

·

Publicado

2023-03-15

·

Atualizado

2024-12-10

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions DrayTek Vigor2960 version 1.5.1.4
Description The issue allows an authenticated attacker with network access to the web management interface to inject operating system commands via the parameter parameter in the mainfunction.cgi component. This can enable the execution of arbitrary commands. The vulnerability exists due to the lack of measures to neutralize special elements.
Recommendations For DrayTek Vigor2960 version 1.5.1.4, consider disabling access to the mainfunction.cgi component or restricting the use of the parameter parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78CWE-77

Identificadores relacionados

BDU:2024-11409
CVE-2023-24229

Produtos afetados

Draytek Vigor2960