CVE-2024-51260

Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)

Published: Oct 31, 2024 / Updated: 19d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

A vulnerability in DrayTek Vigor3900 version 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function. This is a command injection vulnerability, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command).

Impact

The impact of this vulnerability is severe. Attackers can execute arbitrary commands on the affected system, potentially leading to complete system compromise. With the ability to inject and execute malicious commands, an attacker could: 1. Gain unauthorized access to sensitive information 2. Modify or delete critical data 3. Disrupt system operations 4. Use the compromised system as a launching point for further attacks on the network The CVSS v3.1 base score of 9.8 (Critical) indicates that this vulnerability has high impact on confidentiality, integrity, and availability of the system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of an available patch. Users of DrayTek Vigor3900 version 1.5.1.3 should check the vendor's website for any security updates or patches that may have been released since this vulnerability was disclosed.

Mitigation

Until a patch is available, consider the following mitigation strategies: 1. Restrict network access to the affected DrayTek Vigor3900 devices, allowing only trusted IP addresses to connect. 2. Implement strong network segmentation to isolate these devices from critical assets. 3. Monitor logs and network traffic for any suspicious activities or attempts to exploit this vulnerability. 4. If possible, disable or restrict access to the mainfunction.cgi and acme_process function until a patch is available. 5. Consider using a Web Application Firewall (WAF) to help filter out malicious requests. 6. Regularly check for and apply any security updates or patches released by DrayTek. It's crucial to prioritize addressing this vulnerability due to its critical nature and the potential for severe impact on affected systems.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-51260

Oct 31, 2024 at 4:15 PM
First Article

Feedly found the first article mentioning CVE-2024-51260. See article

Oct 31, 2024 at 4:24 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 31, 2024 at 4:24 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 31, 2024 at 7:40 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.9%)

Nov 1, 2024 at 9:55 AM
Static CVE Timeline Graph

Affected Systems

Draytek/vigor3900_firmware
+null more

Attack Patterns

CAPEC-136: LDAP Injection
+null more

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI