CVE-2024-45887: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to doOpenVPN...

CVE-2024-45893

DrayTek Vigor3900 version 1.5.1.3 is susceptible to a post-authentication command injection vulnerability. The flaw exists when the action parameter in the cgi-bin/mainfunction.cgi endpoint is set to setSWMOption, allowing an attacker to execute arbitrary commands. As a temporary workaround, it i...

CVE-2024-45884: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setSWMGroup...

CVE-2024-45882: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletemapprofile...

CVE-2024-45887

The DrayTek Vigor3900 , Vigor 2960 , and Vigor 300B routers are vulnerable to a post-authentication command injection flaw. The issue resides in the doOpenVPN() function within the cgi-bin/mainfunction.cgi script. Specifically, the software fails to neutralize the

CVE-2024-45889: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to commandTable...

CVE-2024-45890: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to downloadovpn...

CVE-2024-45893: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setSWMOption...

CVE-2024-45885: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to autodiscoveryclear...

PT-2024-31836

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.3 Description The issue is a post-authentication command injection vulnerability. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to autodiscovery clear. This vulnerability...

CVE-2024-45890

The DrayTek Vigor3900 (v1.5.1.3) , Vigor 2960 , and Vigor 300B routers are susceptible to a post-authentication command injection vulnerability. The flaw exists within the set_ap_map_config() function of the cgi-bin/mainfunction.cgi script. It is caused by a failure to neutralize

CVE-2024-45885

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to autodiscoveryclear...

PT-2024-31841 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue is a post-authentication command injection vulnerability. This occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to setSWMOption. Recommendations: For...

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference IDOR vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root...

Exploit for OS Command Injection in Php

CVE-2024-4577 Overview CVE-2024-4577 is a security vulner...

The vulnerability of the doPPPoE function in the cgi-bin/mainfunction.cgi file of the DrayTek Vigor 2960 router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the doPPPoE function in the cgi-bin/mainfunction.cgi file of the DrayTek Vigor 2960 router microprogramming system exists due to the failure to take measures to neutralize special commands used in the operating system commands. Exploiting this vulnerability allows a remote...

CVE-2024-22733: NULL Pointer Dereference

TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker...

CVE-2024-51259

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setupcacertificate function...

The vulnerability of the /cgi-bin/v2x00.cgi and /cgi-bin/cgiwcg.cgi web interfaces of DrayTek Vigor software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the /cgi-bin/v2x00.cgi and /cgi-bin/cgiwcg.cgi web interfaces of DrayTek Vigor microprogramming router software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...