CVE-2023-24229

2023-03-1500:00:00

mitre

www.cve.org

draytek vigor2960

os command injection

mainfunction.cgi

cve-2023-24229

authenticated attacker

network access

web management interface

parameter

no longer supported

AI Score

7.8

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi ‘parameter’ parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.