CVE-2024-45882

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.3

Description The issue is a command injection problem that occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to delete map profile. This allows for potential exploitation.

Recommendations For DrayTek Vigor3900 version 1.5.1.3, as a temporary workaround, consider restricting access to the "cgi-bin/mainfunction.cgi" endpoint or avoiding the use of the action parameter with the delete map profile value until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.