CVE-2023-47254: OS Command Injection

Published Dec 9, 2023

Updated

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.

Affected Software

2 affected components

All of the following

DrayTek Vigor167 Firmware=5.2.2

DrayTek Vigor167

Event History

Dec 9, 2023

CVE Published

12:00 AM

Data Sourced

12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2023-47254?

CVE-2023-47254 is considered a critical vulnerability due to its ability to allow remote command execution and privilege escalation.

How do I fix CVE-2023-47254?

To fix CVE-2023-47254, upgrade the DrayTek Vigor167 to a patched firmware version that addresses the OS Command Injection issue.

Who is affected by CVE-2023-47254?

CVE-2023-47254 affects users of the DrayTek Vigor167 running firmware version 5.2.2.

What types of attacks can exploit CVE-2023-47254?

CVE-2023-47254 can be exploited through OS Command Injection attacks from the CLI interface.

What are the potential impacts of exploiting CVE-2023-47254?

Exploiting CVE-2023-47254 can lead to unauthorized remote access, arbitrary command execution, and escalated privileges.