CVE-2022-50994: draytek vigor_2960_firmware OS Command Injection

Vulnerability summary

CVE-2022-50994 is a critical (CVSS 9.2) OS Command Injection vulnerability in draytek vigor_2960_firmware. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.

Timeline

1. 08-05-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.