CVE-2024-45885

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.3

Description The issue is a post-authentication command injection vulnerability. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to autodiscovery clear. This vulnerability happens after logging in.

Recommendations For DrayTek Vigor3900 version 1.5.1.3, as a temporary workaround, consider restricting access to the "cgi-bin/mainfunction.cgi" endpoint or avoiding the use of the action parameter with the autodiscovery clear value until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.