CVE-2024-12986
📋 TL;DR
This critical vulnerability allows remote attackers to execute arbitrary operating system commands on affected DrayTek gateway devices through command injection in the web management interface. Attackers can exploit this to gain full control of the device without authentication. Organizations using DrayTek Vigor2960 or Vigor300B routers with vulnerable firmware versions are affected.
💻 Affected Systems
- DrayTek Vigor2960
- DrayTek Vigor300B
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to pivot to internal networks, steal credentials, install persistent backdoors, or use the device as a botnet node.
Likely Case
Device takeover leading to network reconnaissance, credential harvesting, and potential lateral movement into connected networks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound rules and network segmentation prevents lateral movement.
🎯 Exploit Status
Exploit details have been publicly disclosed. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.1.5
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Download firmware version 1.5.1.5 from DrayTek official website. 2. Log into device web interface. 3. Navigate to System Maintenance > Firmware Upgrade. 4. Upload the new firmware file. 5. Wait for upgrade to complete and device to reboot.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the vulnerable web interface component to prevent exploitation
Navigate to System Maintenance > Management > Web Config and disable HTTP/HTTPS access
Restrict Access with Firewall Rules
allLimit access to the web management interface to trusted IP addresses only
Configure firewall rules to allow only specific management IPs to access port 80/443 on the device
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from critical networks
- Monitor for suspicious command execution patterns and network traffic from affected devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface under System Maintenance > Firmware Information. If version is 1.5.1.3 or 1.5.1.4, device is vulnerable.Check Version:
Check via web interface or SSH: show version (if SSH enabled)Verify Fix Applied:
After upgrade, verify firmware version shows 1.5.1.5 in System Maintenance > Firmware Information.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed login attempts followed by successful access
- Suspicious processes spawned from web interface
Network Indicators:
- Unusual outbound connections from router to external IPs
- Traffic patterns inconsistent with normal router operations
- HTTP requests to /cgi-bin/mainfunction.cgi/apmcfgupptim with suspicious parameters
SIEM Query:
source="router_logs" AND (event="command_execution" OR event="process_spawn" OR uri="/cgi-bin/mainfunction.cgi/apmcfgupptim")