CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability

Published Dec 27, 2024

Updated

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

Other sources

DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

— CISA

Affected Software

7 affected components

DrayTek Vigor2960=1.5.1.4

DrayTek Vigor300B=1.5.1.4

DrayTek Vigor Routers

All of the following

DrayTek Vigor300b Firmware=1.5.1.4

DrayTek Vigor300B

All of the following

DrayTek Vigor2960 Firmware=1.5.1.4

DrayTek Vigor2960

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DrayTek Vigor2960 to a version that resolves this vulnerability.
Fixed in 1.5.1.5
Upgrade
Upgrade DrayTek Vigor300B to a version that resolves this vulnerability.
Fixed in 1.5.1.5
Upgrade
Upgrade DrayTek Vigor3900 to a version that resolves this vulnerability.
Fixed in 1.5.1.5
Compensating control
Follow applicable BOD 22-01 guidance for cloud services.
Compensating control
Discontinue use of the product if mitigations are unavailable.

Event History

Dec 27, 2024

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

May 15, 2025

Known Exploited

via CISA·12:00 AM

Mar 27, 58447

Event

via NVD·02:17 AM

Frequently Asked Questions

What is the severity of CVE-2024-12987?

CVE-2024-12987 is classified as a critical vulnerability.

How do I fix CVE-2024-12987?

To fix CVE-2024-12987, update your DrayTek Vigor2960 or Vigor300B to the latest firmware version that addresses this vulnerability.

What software is affected by CVE-2024-12987?

CVE-2024-12987 affects DrayTek Vigor2960 and Vigor300B running version 1.5.1.4.

What is the impact of CVE-2024-12987?

The impact of CVE-2024-12987 includes potential unauthorized access through the Web Management Interface.

Who is the vendor of the affected products for CVE-2024-12987?

The vendor of the affected products in CVE-2024-12987 is DrayTek.