Medium · published December 27, 2024
CVSS calls it medium at 6.9. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A crafty command injection vulnerability lurks in DrayTek Vigor2960 and Vigor300B devices! 🚨 Just manipulating a single argument can let attackers run arbitrary commands remotely! Think of it like a hotel receptionist who blindly follows any guest's request to access restricted areas without verifying their identity — a dangerous oversight! 🏨 An attacker could exploit this vulnerability to execute malicious commands on your system, potentially gaining access to sensitive data or disrupting services. This could result in unauthorized access or even a complete takeover of the device, depending on the commands executed! ⚠️
Think of it like a hotel receptionist who blindly follows any guest's request to access restricted areas without verifying their identity — a dangerous oversight! 🏨 This vulnerability exists due to inadequate session validation in the web management interface, specifically in the file /cgi-bin/mainfunction.cgi/apmcfgupload. By manipulating the session argument, an attacker can inject and execute arbitrary OS commands.
An attacker could exploit this vulnerability to execute malicious commands on your system, potentially gaining access to sensitive data or disrupting services. This could result in unauthorized access or even a complete takeover of the device, depending on the commands executed! ⚠️ To secure your system, upgrade to version 1.5.1.5 immediately. It’s essential to regularly review and update your devices to protect against known vulnerabilities. Additionally, ensure that access to the management interface is restricted to trusted networks only. You've got this! Follow these steps, and your devices will be safe and sound in no time! 🛡️