DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
DrayTek Vigor: Mehrere Schwachstellen ermöglichen Codeausführung
Advisory ansehen veröffentlicht 2024-10-30
Ein entfernter anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in DrayTek Vigor ausnutzen, um beliebigen Code auszuführen.
01
beschreibt (20)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45891US | — | — | ||
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set… | ||||
| CVE-2024-45889US | — | — | ||
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set… | ||||
| CVE-2024-45885US | — | — | ||
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set… | ||||
| CVE-2024-45884US | — | — | ||
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set… | ||||
| CVE-2024-45882US | — | — | ||
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_prof… | ||||
| CVE-2024-51249US | — | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function. | ||||
| CVE-2024-51252US | critical9.8 | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function. | ||||
| CVE-2024-51248US | high8.8 | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function. | ||||
| CVE-2024-51247US | high8.8 | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function. | ||||
| CVE-2024-51245US | high8.8 | — | ||
In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function. | ||||
| CVE-2024-51244US | high8.8 | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function. | ||||
| CVE-2024-51260US | — | — | ||
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function. | ||||
| CVE-2024-51255US | — | — | ||
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function. | ||||
| CVE-2024-51259US | — | — | ||
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function. | ||||
| CVE-2024-51254US | — | — | ||
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function. | ||||
| CVE-2024-51258US | — | — | ||
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function. | ||||
| CVE-2024-51301US | — | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function. | ||||
| CVE-2024-51298US | — | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. | ||||
| CVE-2024-51257US | — | — | ||
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function. | ||||
| CVE-2024-51304US | — | — | ||
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Advisory Database vom 2024-10-30external
- GitHub Advisory Database vom 2024-10-30external
- GitHub Advisory Database vom 2024-10-30external
- GitHub Advisory Database vom 2024-10-30external
- GitHub Advisory Database vom 2024-10-30external
- GitHub Advisory Database vom 2024-10-30external
- GitHub Advisory Database vom 2024-10-30external
- PoC auf Github vom 2024-10-30external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan