PT-2024-8280 · Draytek · Draytek Vigor300B+2

Published 2024-08-29 · Updated 2024-11-05 · CVE-2024-45887

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.3 DrayTek Vigor 2960 (affected versions not specified) DrayTek Vigor 300B (affected versions not specified)

Description The issue is related to a command injection vulnerability in the doOpenVPN() function of the mainfunction.cgi script in the DrayTek Vigor router firmware. This vulnerability occurs when the action parameter in the cgi-bin/mainfunction.cgi endpoint is set to doOpenVPN. The vulnerability is caused by the lack of neutralization of the < and & characters used in the operating system command when processing the action parameter. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary commands.

Recommendations For DrayTek Vigor3900 version 1.5.1.3: Update to a newer version that contains a fix for this issue. For DrayTek Vigor 2960 and DrayTek Vigor 300B: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-09833

CVE-2024-45887

Affected Products

Draytek Vigor2960

Draytek Vigor300B

Draytek Vigor3900

References · 8

• 🔥 https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45887 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45887 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09833 · Security Note
• https://github.com/N1nEmAn/wp/blob/main/test_v.zip · Note
• https://twitter.com/VulmonFeeds/status/1853643362353435135 · Twitter Post
• https://t.me/cvedetector/9755 · Telegram Post
• https://twitter.com/CVEnew/status/1853449992087720385 · Twitter Post