CVE-2024-51253
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Published: Nov 4, 2024 / Updated: 15d ago
010
CVSS 8EPSS 0.04%High
CVE info copied to clipboard
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
CVE Assignment
NVD published the first details for CVE-2024-51253
Nov 4, 2024 at 2:15 PM
First Article
Feedly found the first article mentioning CVE-2024-51253. See article
Nov 4, 2024 at 2:21 PM / National Vulnerability Database
CVSS Estimate
Feedly estimated the CVSS score as HIGH
Nov 4, 2024 at 2:21 PM
CVSS
A CVSS base score of 8 has been assigned.
Nov 4, 2024 at 5:41 PM / nvd
EPSS
EPSS Score was set to: 0.04% (Percentile: 10.6%)
Nov 5, 2024 at 10:05 AM
Affected Systems
Draytek/vigor3900_firmware
+null more
Attack Patterns
CAPEC-108: Command Line Execution through SQL Injection
+null more
News
CVE Alert: CVE-2024-51253
Everyone that supports the site helps enable new functionality. Affected Endpoints:
NA - CVE-2024-51253 - In Draytek Vigor3900 1.5.1.3, attackers can...
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.
CVE-2024-51253 | Draytek Vigor 3900 1.5.1.3 mainfunction.cgi doL2TP command injection
A vulnerability classified as critical has been found in Draytek Vigor 3900 1.5.1.3 . Affected is the function doL2TP of the file mainfunction.cgi . The manipulation leads to command injection. This vulnerability is traded as CVE-2024-51253 . It is possible to launch the attack remotely. There is no exploit available.
CVE-2024-51253
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP...
CVE-2024-51253
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP...
See 3 more articles and social media posts