DrayTek Vigor 1.5.1.4 < 1.5.1.5 Command Injection

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242052);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/14");

  script_cve_id("CVE-2024-12987");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/06/05");

  script_name(english:"DrayTek Vigor 1.5.1.4 < 1.5.1.5 Command Injection");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of DrakTek Vigor installed on the remote host is 1.5.1.4. It is, therefore, affected by a vulnerability,
which was classified as critical. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload 
of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It 
is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to 
version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.5/DrayTek_Vigor2960_V1.5.1.5_01release-note.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?05b6ef61");
  # https://fw.draytek.com.tw/Vigor300B/Firmware/v1.5.1.5/DrayTek_Vigor300B_V1.5.1.5_01release-note.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95656813");
  # https://fw.draytek.com.tw/Vigor3900/Firmware/v1.5.1.5/DrayTek_Vigor3900_V1.5.1.5_01release-note.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ab897c45");
  script_set_attribute(attribute:"solution", value:
"Upgrade to DrakTek Vigor version 1.5.1.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12987");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:draytek:vigor");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("draytek_vigor_detect.nbin");
  script_require_keys("installed_sw/DrayTek Vigor", "SNMP/port");

  exit(0);
}
include('vcf_extras_draytek.inc');

var port = get_kb_item('SNMP/port');

var app_info = vcf::draytek::vigor::combined_get_app_info(app:'DrayTek Vigor');

var models = [
  'Vigor300B',
  'Vigor2960',
  'Vigor3900'
];

var constraints = [
  { 'equal' : '1.5.1.4', 'fixed_display' : '1.5.1.5' }
];

vcf::draytek::vigor::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    models:models,
    severity:SECURITY_HOLE
);