CVE-2023-1162: DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection

Published Mar 3, 2023

Updated

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument password leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Other sources

A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4. Affected is the function sub1225C of the file mainfunction.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability.

Affected Software

4 affected components

DrayTek Vigor 2960 Firmware=1.5.1.4

DrayTek Vigor 2960

All of the following

DrayTek Vigor 2960 Firmware=1.5.1.4

DrayTek Vigor 2960

Event History

Mar 3, 2023

CVE Published

06:49 AM

Data Sourced

06:49 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-1162?

The severity of CVE-2023-1162 is high.

What is the affected software for CVE-2023-1162?

The affected software for CVE-2023-1162 is DrayTek Vigor 2960 Firmware 1.5.1.4.

How can the vulnerability in CVE-2023-1162 be exploited?

The vulnerability in CVE-2023-1162 can be exploited remotely.

What is the fix for CVE-2023-1162?

A fix for CVE-2023-1162 may be provided by the vendor DrayTek.

What is the CWE ID for CVE-2023-1162?

The CWE ID for CVE-2023-1162 is 77.