CVE-2023-24229: Command Injection
First published: Wed Mar 15 2023(Updated: )
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Draytek Vigor2960 Firmware | =1.5.1.4 | |
| DrayTek Vigor2960 | ||
| All of | ||
| Draytek Vigor2960 Firmware | =1.5.1.4 | |
| DrayTek Vigor2960 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/sadwwcxz/Vul
- https://www.draytek.com/
- https://web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul
- https://www.draytek.co.uk/support/guides/kb-remotemanagement
- https://www.draytek.com/support/knowledge-base/5465
- https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
Frequently Asked Questions
What is the vulnerability ID for the DrayTek Vigor2960 command injection vulnerability?
The vulnerability ID for the DrayTek Vigor2960 command injection vulnerability is CVE-2023-24229.
How severe is the DrayTek Vigor2960 command injection vulnerability?
The severity of the DrayTek Vigor2960 command injection vulnerability is high, with a CVSS score of 7.8.
What is affected by the DrayTek Vigor2960 command injection vulnerability?
The DrayTek Vigor2960 firmware version 1.5.1.4 is affected by the command injection vulnerability.
How can I fix the DrayTek Vigor2960 command injection vulnerability?
To fix the DrayTek Vigor2960 command injection vulnerability, update the firmware to a version that has addressed the issue.
Where can I find more information about the DrayTek Vigor2960 command injection vulnerability?
You can find more information about the DrayTek Vigor2960 command injection vulnerability on the GitHub page and the official DrayTek website.
- collector/nvd-index
- agent/author
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/draytek
- canonical/draytek vigor2960 firmware
- version/draytek vigor2960 firmware/1.5.1.4
- canonical/draytek vigor2960