CVE-2023-24229
📋 TL;DR
This vulnerability allows authenticated attackers with network access to the DrayTek Vigor2960 web management interface to execute arbitrary operating system commands via the 'parameter' parameter in mainfunction.cgi. It affects DrayTek Vigor2960 devices running version 1.5.1.4 that are no longer supported by the vendor.
💻 Affected Systems
- DrayTek Vigor2960
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the device leading to network pivoting, data exfiltration, or deployment of persistent malware on the network.
Likely Case
Unauthorized command execution allowing attackers to modify device configuration, intercept traffic, or disrupt network services.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized access to the management interface.
🎯 Exploit Status
Exploit requires valid credentials for web interface. Public proof-of-concept exists in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Replace with supported hardware.
🔧 Temporary Workarounds
Restrict Management Interface Access
allLimit access to the web management interface to trusted IP addresses only using firewall rules.
Disable Unused Management Features
allDisable remote management features if not required for operations.
🧯 If You Can't Patch
- Replace affected devices with supported hardware
- Implement strict network segmentation to isolate vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at System Maintenance > Firmware InformationCheck Version:
N/A - check via web interfaceVerify Fix Applied:
Verify device has been replaced with supported hardware or isolated from network📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to mainfunction.cgi with parameter parameter
- Multiple failed login attempts followed by successful login and command execution
Network Indicators:
- Unusual outbound connections from router to external IPs
- Traffic patterns indicating command and control activity
SIEM Query:
source="vigor2960" AND (uri="*mainfunction.cgi*" AND param="parameter")🔗 References
- https://github.com/sadwwcxz/Vul
- https://web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul
- https://www.draytek.co.uk/support/guides/kb-remotemanagement
- https://www.draytek.com/
- https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
- https://www.draytek.com/support/knowledge-base/5465
- https://github.com/sadwwcxz/Vul
- https://web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul
- https://www.draytek.co.uk/support/guides/kb-remotemanagement
- https://www.draytek.com/
- https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
- https://www.draytek.com/support/knowledge-base/5465
