CVE-2024-51257

Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)

Published: Oct 30, 2024 / Updated: 20d ago

010
CVSS 8.8EPSS 0.04%High
CVE info copied to clipboard

Summary

DrayTek Vigor3900 version 1.5.1.3 contains a vulnerability that allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.

Impact

This vulnerability could allow attackers to execute arbitrary commands on the affected DrayTek Vigor3900 devices. This could potentially lead to complete system compromise, unauthorized access to sensitive information, modification of system configurations, or use of the device as a pivot point for further attacks on the network.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

Based on the provided information, there is no mention of an available patch. Further investigation may be needed to determine if a patch has been released by DrayTek.

Mitigation

While no specific mitigation steps are provided in the given information, general recommendations may include: 1. Update to a newer version of the firmware if available. 2. Limit access to the device's management interface to trusted IP addresses only. 3. Monitor for any suspicious activities or unauthorized access attempts. 4. Consider implementing additional network segmentation to isolate affected devices. 5. Regularly check for updates and security advisories from DrayTek.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-51257

Oct 30, 2024 at 2:15 PM
First Article

Feedly found the first article mentioning CVE-2024-51257. See article

Oct 30, 2024 at 2:22 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 30, 2024 at 2:22 PM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 30, 2024 at 4:40 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.9%)

Oct 31, 2024 at 10:14 AM
Static CVE Timeline Graph

Affected Systems

Draytek/vigor3900_firmware
+null more

Attack Patterns

CAPEC-136: LDAP Injection
+null more

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI