Description
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| n/a | n/a / n/a | n/a | affected |
| vigor2960_firmware | draytek / vigor2960_firmware | >= 0, < 1.5.1 | affected |
| vigor300b_firmware | draytek / vigor300b_firmware | >= 0, < 1.5.1 | affected |
| vigor3900_firmware | draytek / vigor3900_firmware | >= 0, < 1.5.1 | affected |