CVE-2023-24229

HIGH EXPLOITED IN THE WILD

DrayTek Vigor2960 v1.5.1.4 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-24229 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References (6)

Core 6

Scores

CVSS v3 7.8
EPSS 0.0672
EPSS Percentile 93.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

VulnCheck KEV 2024-09-18
InTheWild.io 2024-09-18
CWE
CWE-77 CWE-78
Status published
Products (1)
draytek/vigor2960_firmware 1.5.1.4
Published Mar 15, 2023
Tracked Since Feb 18, 2026