Critical · published March 26, 2020
🚨 A remote attacker can inject commands into Draytek Vigor devices with a DEBUG mode HTTP request — think of it as allowing an uninvited guest to rewrite the kitchen recipe while you’re cooking! 🔥 Imagine you’re in a restaurant kitchen and a random person walks in, grabs the recipe book, and starts scribbling in it — that’s what this vulnerability allows! The attacker can alter commands on your network device without your knowledge, creating chaos behind the scenes. If exploited, an attacker could potentially take full control of these devices, executing any command they desire. This could lead to unauthorized access, data breaches, and even the ability to manipulate network traffic, putting your entire infrastructure at risk.
Imagine you’re in a restaurant kitchen and a random person walks in, grabs the recipe book, and starts scribbling in it — that’s what this vulnerability allows! The attacker can alter commands on your network device without your knowledge, creating chaos behind the scenes. This command injection vulnerability exists in the /cgi-bin/activate.cgi interface of several Draytek Vigor devices running versions prior to 1.5.1. It allows remote attackers to execute arbitrary commands by sending specially crafted HTTP requests while the device is in DEBUG mode.
If exploited, an attacker could potentially take full control of these devices, executing any command they desire. This could lead to unauthorized access, data breaches, and even the ability to manipulate network traffic, putting your entire infrastructure at risk. Upgrade your Draytek Vigor devices to version 1.5.1 or later immediately. Additionally, consider disabling DEBUG mode to reduce exposure and review your network security policies to safeguard against unauthorized access. This is fixable! Follow these steps and you’ll be well on your way to securing your devices. 🛡️