CVE-2021-43118

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2960 version 1.5.1.3 DrayTek Vigor 3900 version 1.5.1.3 DrayTek Vigor 300B version 1.5.1.3

Description A Remote Command Injection issue exists in the mainfunction.cgi script of the DrayTek Vigor web interface due to inadequate data sanitization at the management level. This could allow a remote attacker to execute arbitrary code by sending a crafted HTTP message with a malformed QUERY STRING to the mainfunction.cgi endpoint.

Recommendations For DrayTek Vigor 2960 version 1.5.1.3, consider disabling the mainfunction.cgi script until a patch is available. For DrayTek Vigor 3900 version 1.5.1.3, restrict access to the mainfunction.cgi endpoint to minimize the risk of exploitation. For DrayTek Vigor 300B version 1.5.1.3, avoid using the QUERY STRING parameter in the mainfunction.cgi endpoint until the issue is resolved.