PT-2020-7000 · Draytek · Draytek Vigor300B+2

Cossack9989

+1

·

Published

2020-05-29

·

Updated

2025-02-06

·

CVE-2020-14472

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Draytek Vigor3900 versions prior to 1.5.1.1 Draytek Vigor2960 versions prior to 1.5.1.1 Draytek Vigor300B versions prior to 1.5.1.1
Description The issue concerns command-injection vulnerabilities in the mainfunction.cgi file of the affected devices. This vulnerability exists due to inadequate data cleaning at the management level, allowing a remote attacker to inject arbitrary commands.
Recommendations For Draytek Vigor3900 versions prior to 1.5.1.1, update to version 1.5.1.1 or later. For Draytek Vigor2960 versions prior to 1.5.1.1, update to version 1.5.1.1 or later. For Draytek Vigor300B versions prior to 1.5.1.1, update to version 1.5.1.1 or later. As a temporary workaround, consider restricting access to the mainfunction.cgi file until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-11423
CVE-2020-14472

Affected Products

Draytek Vigor2960
Draytek Vigor300B
Draytek Vigor3900