PT-2024-34588 · Draytek · Draytek Vigor3900
CVE-2024-51298
·
Published
2024-10-30
·
Updated
2024-11-01
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Draytek Vigor3900 version 1.5.1.3
Description
The issue allows attackers to inject malicious commands into
mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.Recommendations
For Draytek Vigor3900 version 1.5.1.3, as a temporary workaround, consider disabling the
doGRETunnel function until a patch is available. Restrict access to the mainfunction.cgi to minimize the risk of exploitation.Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Draytek Vigor3900