300 matches found
CVE-2024-51258
CVE-2024-51258 affects DrayTek Vigor3900 firmware version 1.5.1.3 . Vulnerability arises in the internal web endpoint mainfunction.cgi via the function doSSLTunnel , allowing an attacker to inject and execute arbitrary commands. The CVE's CVSS v3.1 metrics indicate a network-facilitated, low-priv...
CVE-2024-51296
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function...
CVE-2024-51299
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function...
PT-2024-34591 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get rrd function. Recommendations: For Draytek Vigor3900 version 1.5.1....
CVE-2024-51301
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packetmonitor function...
PT-2024-34592 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet monitor function. Recommendations: For Draytek Vigor3900 version...
CVE-2024-51257
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function...
CVE-2024-51299
CVE-2024-51299 affects Draytek Vigor3900, version 1.5.1.3. The flaw allows an attacker to inject commands into mainfunction.cgi and execute arbitrary commands via the dumpSyslog function. Documented impact is high (remote network attack with full system compromise) with CVSS v3.1: AV:N/AC:L/PR:L/...
CVE-2024-51304
CVE-2024-51304 affects Draytek Vigor3900, version 1.5.1.3. The vulnerability arises in the web interface script mainfunction.cgi, where input handling around ldap_search_dn allows an attacker to inject and execute arbitrary commands. CVSS v3.1 base score 8.8 (Network, Low attack complexity, Privi...
PT-2024-34588 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. Recommendations: For Draytek Vigor3900 version...
CVE-2024-51301
DrayTek Vigor3900 (firmware 1.5.1.3) is affected by CVE-2024-51301. The issue allows an attacker to inject commands into mainfunction.cgi and execute arbitrary commands via the packet_monitor function, constituting remote code execution over the network. The vulnerability affects the mainfunction...
CVE-2024-51300
CVE-2024-51300 affects Draytek Vigor3900, firmware version 1.5.1.3. Multiple sources confirm an authentication-agnostic command-injection in the web-facing CGI endpoint: attackers can inject commands into mainfunction.cgi and trigger execution of arbitrary commands by invoking the get_rrd functio...
PT-2024-34587 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function. Recommendations: For Draytek Vigor3900 version...
CVE-2024-51299
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function...
PT-2024-34580 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function. Recommendations: For DrayTek Vigor3900 version...
PT-2024-34579 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function. Recommendations: For DrayTek Vigor3900 version...
CVE-2024-51298
DrayTek Vigor3900 firmware 1.5.1.3 exposes a command-injection in mainfunction.cgi via the doGRETunnel function, enabling arbitrary code execution over the network (CVE-2024-51298). Impact is high (remote, unauthenticated, total compromise) per CVSS 3.1 metrics. Mitigation/workaround from PT-2024...
PT-2024-7996 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 3900 version 1.5.1.3 Description: The issue exists due to the lack of neutralization of special elements used in the operating system command in the modifyrow function of the mainfunction.cgi file in the DrayTek Vigor 3900...
PT-2024-7998 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename table function. This is due to the lack of measures to neutraliz...
