CVE-2021-43118
CRITICALDrayTek Vigor 2960/3900/300B 1.5.1.3 - Remote Command Injection via mainfunction.cgi
Title source: llmDescription
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26
Scores
CVSS v3
9.8
EPSS
0.3484
EPSS Percentile
98.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
Status
published
Products (3)
draytek/vigor2960_firmware
1.5.1.3
draytek/vigor300b_firmware
1.5.1.3
draytek/vigor3900_firmware
1.5.1.3
Published
Mar 29, 2022
Tracked Since
Feb 18, 2026