High severity · published Mar 15, 2023
CVE-2023-24229
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi…
7.8
CVSS
6.7%
EPSS
No
On KEV
Description
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Vigor2960 Firmware · Draytek
1.5.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24229
Exploit
https://github.com/sadwwcxz/Vul
web.archive.org
https://web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul
www.draytek.co.uk
https://www.draytek.co.uk/support/guides/kb-remotemanagement
Not Applicable
https://www.draytek.com/
www.draytek.com
https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
www.draytek.com
https://www.draytek.com/support/knowledge-base/5465
More from Vigor2960 Firmware
9.8
CVE-2024-12987
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
9.8
CVE-2020-15415
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
9.8
CVE-2020-8515
Multiple DrayTek Vigor Routers Web Management Page Vulnerability
9.9
CVE-2026-113391
DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
9.9
CVE-2026-113390
DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection