CVE-2024-51301

Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)

Published: Oct 30, 2024 / Updated: 20d ago

010
CVSS 8.8EPSS 0.04%High
CVE info copied to clipboard

Summary

In Draytek Vigor3900 version 1.5.1.3, there is a vulnerability that allows attackers to inject malicious commands into the mainfunction.cgi file and execute arbitrary commands by calling the packet_monitor function. This is classified as a Command Injection vulnerability (CWE-77).

Impact

The impact of this vulnerability is severe. Attackers can execute arbitrary commands on the affected system, potentially leading to complete system compromise. With a CVSS base score of 8.8 (High), this vulnerability has high impacts on confidentiality, integrity, and availability. Attackers can potentially access sensitive information, modify system data, and disrupt system operations. The attack vector is network-based, requires low attack complexity, and no user interaction, making it relatively easy for attackers to exploit.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of an available patch for this vulnerability. The security team should closely monitor for any updates or patches released by Draytek for the Vigor3900 router.

Mitigation

Until a patch is available, consider the following mitigation strategies: 1. Restrict network access to the affected Draytek Vigor3900 routers, particularly to the management interface. 2. Implement strong network segmentation to isolate affected devices. 3. Monitor logs for any suspicious activities related to the mainfunction.cgi file or packet_monitor function. 4. If possible, disable or restrict access to the packet_monitor function. 5. Regularly check for firmware updates from Draytek and apply them as soon as they become available. 6. Consider using Web Application Firewalls (WAF) or Intrusion Prevention Systems (IPS) to detect and block potential command injection attempts. 7. Conduct a thorough security audit of all Draytek Vigor3900 routers in the network.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-51301

Oct 30, 2024 at 2:15 PM
First Article

Feedly found the first article mentioning CVE-2024-51301. See article

Oct 30, 2024 at 2:22 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 30, 2024 at 2:22 PM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 30, 2024 at 6:40 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.9%)

Oct 31, 2024 at 10:14 AM
Static CVE Timeline Graph

Affected Systems

Draytek/vigor3900
+null more

Attack Patterns

CAPEC-136: LDAP Injection
+null more

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI