Research · Dec 30, 2024
Critical OS Command Injection Vulnerability in DrayTek Vigor Routers
A critical OS command injection vulnerability has been identified in DrayTek Vigor routers, necessitating immediate upgrades to safeguard against potential exploitation.
What changed
A significant vulnerability has been discovered in DrayTek Vigor2960 and Vigor300B routers, specifically in the Web Management Interface's handling of session arguments. This flaw allows for OS command injection, which could be exploited remotely.
- The vulnerability is classified as critical, indicating a high risk of exploitation.
- Affected routers include Vigor2960 and Vigor300B running firmware version 1.5.1.4.
- The issue is linked to the file /cgi-bin/mainfunction.cgi/apmcfgupload.
Who is affected
Users of DrayTek Vigor routers should be aware of the potential risks associated with this vulnerability. Organizations relying on these devices for network management are particularly at risk.
- DrayTek Vigor2960 routers.
- DrayTek Vigor300B routers.
- Organizations utilizing DrayTek products for enterprise networking.
What to do
To mitigate the risks associated with this vulnerability, users are strongly advised to upgrade their firmware to version 1.5.1.5. This update addresses the critical OS command injection flaw.
- Upgrade to firmware version 1.5.1.5 immediately.
- Review security protocols related to router management.
- Monitor network traffic for any unusual activity that may indicate exploitation attempts.