github.com
https://github.com/N1nEmAn/wp/blob/main/test_v.zip CVE-2024-45888
HIGH
DrayTek vigor3900_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Record summary
CVE-2024-45888 has a selected CVSS score of 8.0 (high).
Description
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Aug 22, 2025 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 4, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
vigor3900_firmwareBrowse DrayTek / vigor3900_firmwareDefault status: unknown | VulnCheck, CVE List | 1.5.1.3 | affected |
References
3github.com
https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-45888