Vulnerability
Remote execution is possible for DrayTek devices of versions Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta . The remote code execution is done through shell metacharacters into the cgi-bin/mainfunction.cgi URI. This vulnerability has been fixed in Vigor3900/2960/300B v1.5.1.
Mitigation / Precaution
In order to patch this vulnerability, please install the official patch DrayTek made available for supported, vulnerable instances.
Written by
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 10 days
