CVE-2024-48074

DrayTek Vigor2960 (v1.4.4) exposes an authorized RCE via the table parameter in the doPPPoE function (cgi-bin/mainfunction.cgi); an attacker can inject a command that is executed by the system function. Impact is high per CVSS metrics. Remediation/workaround from PT-2024-7515: temporarily disable...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...