CVE-2024-12986
Published: 27 December 2024
Summary
CVE-2024-12986 is a medium-severity Command Injection (CWE-77) vulnerability in Draytek Vigor300B Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical OS command injection vulnerability affects the web management interface of DrayTek Vigor2960 and Vigor300B devices running firmware versions 1.5.1.3 and 1.5.1.4. The flaw resides in the apmcfgupptim endpoint of /cgi-bin/mainfunction.cgi, where unsanitized input to the session argument allows arbitrary command execution. Both CWE-77 and CWE-78 apply, and the issue is remotely reachable without authentication.
An attacker with network access to the management interface can supply crafted session values to execute operating system commands on the device. Successful exploitation yields limited impacts to confidentiality, integrity, and availability, consistent with the CVSS 6.9 rating, but can still enable configuration changes or further lateral movement within the affected gateway.
Public references, including a detailed disclosure on Notion and entries on Vuldb, confirm that upgrading to firmware version 1.5.1.5 resolves the vulnerability. Administrators are advised to apply the update promptly, as the exploit code has already been published.
The EPSS score currently stands at 0.7063 with a recorded peak of 0.7322, indicating sustained and moderately elevated exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51245
Vulnerability details
A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi/apmcfgupptim of the component Web Management Interface. The manipulation of the argument session leads to…
more
os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection via public-facing web management interface (/cgi-bin/mainfunction.cgi/apmcfgupptim) enables exploitation of public-facing application (T1190) leading to remote command execution using Unix shell (T1059.004) on the DrayTek router OS.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.