CVE-2024-45893: Command Injection
Published Nov 4, 2024
·Updated
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setSWMOption.
Affected Software
1 affected component
DrayTek Vigor3900
Event History
Nov 4, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-45893?
CVE-2024-45893 is considered a critical vulnerability due to its potential for command injection post-authentication.
2
How do I fix CVE-2024-45893?
To fix CVE-2024-45893, update the DrayTek Vigor3900 to the latest firmware version released by DrayTek.
3
What components are affected by CVE-2024-45893?
CVE-2024-45893 affects the DrayTek Vigor3900 router specifically when using firmware version 1.5.1.3.
4
What does CVE-2024-45893 allow attackers to do?
CVE-2024-45893 allows attackers to execute arbitrary commands on the system due to the command injection flaw.
5
Is CVE-2024-45893 easily exploitable?
Yes, CVE-2024-45893 can be readily exploited if the attacker has post-authentication access to the system.