CVE-2024-45884

HIGH

DrayTek vigor3900_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-45884 has a selected CVSS score of 8.0 (high).

Description

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.`

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 22, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 4, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

vigor3900_firmware

Browse DrayTek / vigor3900_firmware

Default status: unknown

VulnCheck, CVE List1.5.1.3affected

References

3