{"id":"CVE-2024-12987","kind":"vulnerability","aliases":["CVE-2024-12987"],"related":[],"title":"A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4","description":"A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.","summary":"DrayTek Vigor2960, Vigor300B and Vigor3900 routers have an OS command injection flaw in the web management interface at /cgi-bin/mainfunction.cgi/apmcfgupload. An attacker can run operating system commands on the router, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-05-15T00:00:00+00:00","products":[{"name":"DrayTek Vigor Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"draytek vigor300b firmware","fixed":[],"affected":"= 1.5.1.4","ecosystem":"vendor"},{"name":"draytek vigor2960 firmware","fixed":[],"affected":"= 1.5.1.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["draytek","exploited","infrastructure","self-hosted","vigor2960","vigor300b","vigor3900"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Apply the vendor mitigation per DrayTek instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2024-12-27T16:15:24+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:33+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:48:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per DrayTek instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).\nunknown","reach":"unknown","summary":"DrayTek Vigor2960, Vigor300B and Vigor3900 routers have an OS command injection flaw in the web management interface at /cgi-bin/mainfunction.cgi/apmcfgupload. An attacker can run operating system commands on the router, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["draytek","vigor2960","vigor300b","vigor3900","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router.","analyst_note":"Sources do not give firmware fixed versions, the exact exposure condition (web management exposed to WAN?), or the vendor advisory; check DrayTek security advisories and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000463,"input_tokens":2573,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12987':18A,21A '-2024':17A,20A '/cgi-bin/mainfunction.cgi/apmcfgupload':58B,99C '1.5.1.4':15A,90C '1.5.1.5':140C 'abl':142C 'activ':74B 'address':144C 'affect':91C,153C 'argument':110C 'attack':60B,123C 'cisa':70B 'classifi':5A,80C 'command':49B,65B,115C 'compon':102C,154C 'critic':7A,82C 'cve':16A,19A 'disclos':129C 'draytek':11A,22A,25A,28A,31B,40B,86C 'exploit':32B,75B,126C 'file':98C 'firmware':27A,30A 'flaw':51B 'found':9A,84C 'function':95C 'host':36B 'infrastructur':33B 'inject':50B,116C 'interfac':56B,105C 'issu':146C 'launch':121C 'lead':112C 'list':71B 'manag':55B,104C 'manipul':107C 'may':134C 'oper':63B 'os':48B,114C 'possibl':119C 'public':132C 'recommend':149C 'remot':124C 'router':45B,68B 'routers':24A 'run':62B 'self':35B 'self-host':34B 'session':111C 'system':64B 'unknown':94C 'upgrad':137C,151C 'use':136C 'version':139C 'vigor':23A 'vigor2960':12A,29A,37B,41B,87C 'vigor300b':14A,26A,38B,42B,89C 'vigor3900':39B,44B 'vulner':2A,77C 'web':54B,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-12-27T16:15:24+00:00","kev":{"dateAdded":"2025-05-15","dueDate":"2025-06-05","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-12987","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12987","severity":null,"published_at":"2025-05-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-12987","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12987","severity":null,"published_at":"2024-12-27T16:15:24+00:00","modified_at":"2026-06-17T07:00:55+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}