CVE-2024-45887: Command Injection
Published Nov 4, 2024
·Updated
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to doOpenVPN.
Affected Software
1 affected component
DrayTek Vigor3900
Event History
Nov 4, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-45887?
CVE-2024-45887 is considered a high-severity vulnerability due to the potential for command injection post-authentication.
2
How do I fix CVE-2024-45887?
To mitigate CVE-2024-45887, update the DrayTek Vigor3900 to the latest firmware version that addresses this vulnerability.
3
What types of attacks can exploit CVE-2024-45887?
CVE-2024-45887 can be exploited to execute arbitrary commands on the affected server after successful authentication.
4
Which devices are affected by CVE-2024-45887?
CVE-2024-45887 affects the DrayTek Vigor3900 running firmware version 1.5.1.3.
5
Is CVE-2024-45887 a remote or local vulnerability?
CVE-2024-45887 is considered a local vulnerability as it requires post-authentication access to exploit.