CVE-2024-12987
DrayTek Vigor Routers OS Command Injection Vulnerability
Description
CVE-2024-12987 is a high-severity OS command injection vulnerability in DrayTek Vigor2960 and Vigor300B routers running firmware version 1.5.1.4. The flaw exists in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint of the Web Management Interface, where the session parameter is not properly sanitized, allowing a remote unauthenticated attacker to inject and execute arbitrary operating system commands. With a CVSS v3.1 base score of 7.3, this command injection vulnerability enables remote compromise of affected network devices. CISA has added CVE-2024-12987 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 5, 2025, and its EPSS score of 78.36% at the 99th percentile indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| draytek | vigor300b firmware | 1.5.1.4 |
| draytek | vigor2960 firmware | 1.5.1.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://netsecfish.notion.site/Command-Injection-in-apmcfgupload-endpoint-for-DrayTek-Gateway-Devices-1676b683e67c8040b7f1f0ffe29ce18f?pvs=4(Exploit, Third Party Advisory)
- https://vuldb.com/?ctiid.289380(Permissions Required, VDB Entry)
- https://vuldb.com/?id.289380(Third Party Advisory, VDB Entry)
- https://vuldb.com/?submit.468795(Third Party Advisory, VDB Entry)
- https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.5/DrayTek_Vigor2960_V1.5.1.5_01release-note.pdf(Release Notes)
- https://fw.draytek.com.tw/Vigor300B/Firmware/v1.5.1.5/DrayTek_Vigor300B_V1.5.1.5_01release-note.pdf(Release Notes)
- https://fw.draytek.com.tw/Vigor3900/Firmware/v1.5.1.5/DrayTek_Vigor3900_V1.5.1.5_01release-note.pdf(Not Applicable)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12987(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-12987 is classified under CWE-77, Command Injection, where the application constructs commands using externally-influenced input without properly neutralizing special elements. In DrayTek Vigor routers, the apmcfgupload CGI handler incorporates the session parameter into system commands without sanitization, allowing attackers to inject additional commands that execute on the router's operating system.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
This vulnerability also falls under CWE-78, OS Command Injection, as the injected commands are specifically executed by the router's operating system shell. The unsanitized session parameter allows shell metacharacters to be interpreted, enabling the attacker to chain arbitrary OS commands that run with the privileges of the web server process on the DrayTek router.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2024-12987 carries a CVSS v3.1 base score of 7.3 (High) and is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). Confidentiality, integrity, and availability are all impacted at a low level (C:L/I:L/A:L), though the practical impact of command injection on a network router is typically more severe than the CVSS sub-scores suggest. An attacker gaining command execution on a DrayTek router can intercept and modify network traffic, alter DNS settings to redirect users to malicious sites, disable security features, establish persistent backdoor access, and use the router as a pivot point to attack internal network resources. The EPSS score of 78.36% at the 99th percentile is exceptionally high, indicating that this vulnerability is among the most actively exploited across all tracked CVEs. Public exploit code is available via Netsecfish's disclosure, making exploitation trivial for any attacker.
Exploit Maturity
CVE-2024-12987 demonstrates the highest level of exploit maturity. CISA has confirmed active exploitation in the wild by adding it to the Known Exploited Vulnerabilities catalog. Public exploit code is available through Netsecfish's detailed disclosure, and the vulnerability is tracked in VulDB with additional technical details. The EPSS score of 78.36% at the 99th percentile confirms near-certain exploitation activity. DrayTek routers are widely deployed in small and medium businesses, making them attractive targets for botnet operators and threat actors seeking network-level access. The combination of public exploit availability, no authentication requirement, and network-edge deployment makes this vulnerability an extremely high-priority remediation target.
Remediation
- Upgrade firmware immediately. Update DrayTek Vigor2960 and Vigor300B routers to firmware version 1.5.1.5 or later. Release notes are available for Vigor2960 and Vigor300B.
- Restrict Web Management Interface access. Disable remote management access from the WAN interface. If remote management is necessary, restrict it to specific trusted IP addresses and use VPN access instead of direct internet exposure.
- Audit router configurations. After patching, review router configurations for unauthorized changes including modified DNS settings, new firewall rules, unexpected port forwarding entries, or rogue administrative accounts that may indicate prior compromise.
- Monitor for indicators of compromise. Check router logs for unusual requests to
/cgi-bin/mainfunction.cgi/apmcfgupload, especially those containing shell metacharacters in thesessionparameter. Look for unexpected outbound connections that could indicate command-and-control communication. - Implement network monitoring. Deploy network traffic analysis to detect anomalous traffic patterns from routers, including unexpected DNS queries, connections to known malicious IPs, or unusual bandwidth usage that could indicate the router has been compromised and enlisted in a botnet.
Technical Details
CVE-2024-12987 is a command injection vulnerability in the DrayTek Vigor2960 and Vigor300B Web Management Interface. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L confirms a network-accessible attack requiring no privileges, no user interaction, with low complexity and low impact across all CIA dimensions.
The vulnerability exists in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint, which processes the session parameter. The CGI handler constructs an operating system command incorporating the session parameter value without sanitizing shell metacharacters. This is a compound weakness combining CWE-77 (generic command injection) and CWE-78 (OS command injection), as the injected input is interpreted directly by the router's system shell. An attacker sends an HTTP request to the vulnerable endpoint with a crafted session parameter containing command injection payloads using characters such as semicolons (;), pipes (|), backticks, or command substitution sequences ($()). The injected commands execute with the privileges of the web server process, which on embedded DrayTek devices typically runs as root, granting complete control over the device.
Frequently Asked Questions
Is CVE-2024-12987 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2024-12987 to the KEV catalog. Public exploit code is available through Netsecfish's disclosure. The EPSS score of 78.36% at the 99th percentile indicates near-certain exploitation activity.
What products are affected by CVE-2024-12987?
DrayTek Vigor2960 and Vigor300B routers running firmware version 1.5.1.4 are confirmed affected. Organizations should upgrade to firmware version 1.5.1.5 or later.
How do I fix CVE-2024-12987?
Update DrayTek Vigor2960 and Vigor300B firmware to version 1.5.1.5 or later. Disable remote management access from the WAN interface, and restrict access to the Web Management Interface to trusted networks only.
How severe is CVE-2024-12987?
CVE-2024-12987 has a CVSS v3.1 base score of 7.3 (High). It requires no authentication or user interaction and is exploitable remotely. The EPSS score of 78.36% at the 99th percentile places it among the most actively exploited vulnerabilities, and public exploit code is freely available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.