Vulnerabilities/CVE-2023-24229

CVE-2023-24229: draytek vigor2960 Command Injection

SSVC decisionAttendEscalate and remediate ahead of routine patching.

ExploitationPoC

AutomatableNo

Technical impactTotal

Mission & well-beingHigh (assumed)

Source: CISA-ADP, SSVC v2.0.3As of 16-07-2024 13:44 UTCCISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Modified

Published 15-03-2023Last modified 02-08-2024

On this page

Summary Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

Published15-03-2023

Modified02-08-2024

SourceCVE.org

CVSS7.8

EPSS6.72%

KEV0

Exploits1

Vulnerability summary

CVE-2023-24229 is a high (CVSS 7.8) Command Injection vulnerability in draytek vigor2960. EPSS estimates a 6.72% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

43/100

0100

Medium · default modelHow is this calculated?

SSVC decisionAttendEscalate and remediate ahead of routine patching.

ExploitationPoC

AutomatableNo

Technical impactTotal

Mission & well-beingHigh (assumed)

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

6.72%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

15-03-2023
PublishedVulnerability first disclosed.
02-08-2024
Last modifiedVulnerability information updated.

Description

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS metrics

2 scores · 2 sources · 1 version

v3.17.8

High 7.8Preferred score · CVE.org (CNA)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SourcesAll 2 agree

NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS trend

Probability

6.72%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.72% on 22-09-2026

100%75%50%25%0%

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Vul
Maturity: poc

Weaknesses

CWE · root cause

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Draytek1 product

vigor29601.5.1.4

1 vendor · 1 product

References

6 links

www.draytek.comNot Applicable
github.com/sadwwcxz/VulExploitThird Party Advisory
web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul
www.draytek.co.uk/support/guides/kb-remotemanagement
www.draytek.com/support/knowledge-base/5465
www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960

Related vulnerabilities

HighCVE-2026-113396draytek · vigor29602d agoDrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injectionA weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.EPSS1.46%HighCVE-2026-113397draytek · vigor29602d agoDrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injectionA security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.EPSS1.01%HighCVE-2026-113392draytek · vigor29602d agoDrayTek Vigor2960 Apmupload mainfunction.cgi path traversalA vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.41%MediumCVE-2026-113393draytek · vigor29602d agoDrayTek Vigor2960 commonupload mainfunction.cgi unrestricted uploadA vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.35%HighCVE-2026-113394draytek · vigor29602d agoDrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversalA vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.32%HighCVE-2026-113395draytek · vigor29602d agoDrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversalA security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.41%

All vulnerabilities invigor2960