PT-2026-38912 · Draytek · Vigor2960

Published 2026-05-08 · Updated 2026-05-09 · CVE-2022-50994

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2960 versions prior to 1.5.1.4

Description An OS command injection issue exists in the CGI login handler. Unauthenticated remote attackers can execute arbitrary commands with web server privileges by injecting shell metacharacters into the formpassword parameter. This occurs because unsanitized input is passed to the otp check.sh script. Successful exploitation requires a valid username and for the target account to have MOTP (Mobile One-Time Password) authentication enabled.

Recommendations Update to version 1.5.1.4 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-50994

Affected Products

Vigor2960

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-50994 · Security Note
• https://draytek.co.uk/support/downloads/vigor-2960/older-firmware/firmware-1514?task=download.send&id=2597:readme-v2960-1514&catid=1251 · Patch
• https://draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960 · Vendor Advisory
• https://vulncheck.com/advisories/draytek-vigor-2960-os-command-injection-via-mainfunction-cgi · Note
• https://twitter.com/CVEnew/status/2053174671017746532 · Twitter Post