CVE-2024-48153: Command Injection
Published Oct 14, 2024
·Updated
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the getsubconfig function.
Affected Software
1 affected component
DrayTek Vigor3900
Event History
Oct 14, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-48153?
The severity of CVE-2024-48153 is considered critical due to the potential for arbitrary command execution.
2
How do I fix CVE-2024-48153?
To fix CVE-2024-48153, immediately update the DrayTek Vigor3900 firmware to the latest version provided by the vendor.
3
What types of attacks does CVE-2024-48153 allow?
CVE-2024-48153 allows attackers to inject and execute arbitrary commands on the DrayTek Vigor3900 router.
4
Which versions of the DrayTek Vigor3900 are affected by CVE-2024-48153?
CVE-2024-48153 affects DrayTek Vigor3900 devices running firmware version 1.5.1.3.
5
What are the consequences of exploiting CVE-2024-48153?
Exploiting CVE-2024-48153 can lead to unauthorized access and control over the affected DrayTek Vigor3900 router.