CVE-2022-50994: DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi
DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otpcheck.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DrayTek Vigor 2960to a version that resolves this vulnerability.Fixed in 1.5.1.4 - Configuration
Ensure the otp_check.sh script does not pass unsanitized user input (from the formpassword parameter) to OS command execution; apply the vendor firmware fix associated with updating to 1.5.1.4.
DrayTek Vigor 2960 CGI login handler formpassword parameter handling (sanitization) = sanitized/validated input before being passed to otp_check.sh
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50994?
CVE-2022-50994 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-50994?
To fix CVE-2022-50994, upgrade the DrayTek Vigor 2960 firmware to version 1.5.1.4 or later.
Who is affected by CVE-2022-50994?
CVE-2022-50994 affects users of the DrayTek Vigor 2960 running firmware versions prior to 1.5.1.4.
What type of vulnerability is CVE-2022-50994?
CVE-2022-50994 is classified as an OS command injection vulnerability.
Can CVE-2022-50994 be exploited by unauthenticated users?
Yes, CVE-2022-50994 can be exploited by unauthenticated remote attackers.