high8.0

CVE-2024-45893

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.

Impact

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`

Affected products

Vendor	Product	Affected versions
Draytek	Vigor3900 Firmware	Version 1.5.1.3

Weakness classification

CWE-78

References

NVD record
CVE.org record
https://github.com/N1nEmAn/wp/blob/main/test_v.zip
https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf