DrayTek Vigor: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 20

• Critical 9.8
  CVE-2024-51255

  DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…

  Oct 31, 2024
• Critical 9.8
  CVE-2024-51259

  DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…

  Oct 31, 2024
• Critical 9.8
  CVE-2024-51260

  DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…

  Oct 31, 2024
• Critical 9.8
  CVE-2024-51298

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Oct 30, 2024
• High 8.8
  CVE-2024-51254

  DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…

  Oct 31, 2024
• High 8.8
  CVE-2024-51257

  DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…

  Oct 30, 2024
• High 8.8
  CVE-2024-51258

  DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…

  Oct 30, 2024
• High 8.8
  CVE-2024-51301

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Oct 30, 2024
• High 8.8
  CVE-2024-51304

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Oct 30, 2024
• High 8.0
  CVE-2024-45882

  DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` param…

  Nov 4, 2024
• High 8.0
  CVE-2024-45884

  DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs whe…

  Nov 4, 2024
• High 8.0
  CVE-2024-45885

  DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs whe…

  Nov 4, 2024
• High 8.0
  CVE-2024-45889

  DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs whe…

  Nov 4, 2024
• High 8.0
  CVE-2024-45891

  DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs whe…

  Nov 4, 2024
• High 8.0
  CVE-2024-51244

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Nov 1, 2024
• High 8.0
  CVE-2024-51245

  In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Nov 1, 2024
• High 8.0
  CVE-2024-51247

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Nov 1, 2024
• High 8.0
  CVE-2024-51248

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Nov 1, 2024
• High 8.0
  CVE-2024-51249

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Nov 4, 2024
• High 8.0
  CVE-2024-51252

  In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…

  Nov 1, 2024

Revision history

1. 2024-11-05 #5

   CVE's ergänzt

2. 2024-11-04 #4

   CVE ergänzt

3. 2024-11-03 #3

   CVE's ergänzt

4. 2024-10-31 #2

   CVE's ergänzt

5. 2024-10-30 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-64xw-25gj-x6w6
• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-8xq2-3cqg-9xfj
• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-fh9m-mpjc-38hg
• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-fv52-m5w8-2242
• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-v76h-6p79-mvh2
• PoC auf Github vom 2024-10-30
  https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-jwgw-4h9p-rxx6
• GitHub Advisory Database vom 2024-10-30
  https://github.com/advisories/GHSA-qq59-g9rc-v6vx