CVE-2024-12986

CVE-2024-12986 is an OS command injection flaw in the web management interface of DrayTek Vigor2960 and Vigor300B gateways running firmware 1.5.1.3 or 1.5.1.4. It is triggered by sending a crafted, unauthenticated HTTP request to the /cgi-bin/mainfunction.cgi/apmcfgupptim endpoint with a manipulated 'session' argument, which is passed into an OS command. A remote attacker with no privileges or user interaction gains the ability to execute arbitrary operating-system commands on the affected device. Any organization running these two DrayTek models on the affected firmware is exposed, particularly where the web management interface is reachable from untrusted networks. A public proof-of-concept has been disclosed, EPSS assigns a 32.8% probability of exploitation within 30 days (98th percentile), the flaw is not yet in CISA KEV, and there is no confirmed in-the-wild exploitation.

What to do: Upgrade Vigor2960 and Vigor300B firmware to version 1.5.1.5 or later. Until patched, restrict access to the web management interface (allow it only from trusted management networks and avoid WAN exposure), and check device firmware versions plus logs for unexpected requests to /cgi-bin/mainfunction.cgi/apmcfgupptim.