CVE-2024-48074
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on DrayTek Vigor2960 routers by injecting malicious commands into the table parameter of the doPPPoE function. Attackers with valid credentials can achieve remote code execution, potentially compromising the entire router and connected networks. Only DrayTek Vigor2960 routers running version 1.4.4 are affected.
💻 Affected Systems
- DrayTek Vigor2960
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, pivot to internal networks, install persistent backdoors, and use router as attack launch point.
Likely Case
Router takeover enabling traffic interception, credential theft, network reconnaissance, and potential lateral movement to connected devices.
If Mitigated
Limited impact if strong authentication controls, network segmentation, and proper monitoring are in place to detect and block exploitation attempts.
🎯 Exploit Status
Exploit requires authentication but is straightforward to execute once credentials are obtained. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check DrayTek official website for firmware updates. If patch is available, download latest firmware and upload via router web interface under System Maintenance > Firmware Upgrade.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Change default credentials
allUse strong, unique passwords for router admin accounts
🧯 If You Can't Patch
- Implement network segmentation to isolate router management interface
- Deploy network monitoring to detect command injection attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Maintenance > Firmware Information. If version is 1.4.4, router is vulnerable.Check Version:
No CLI command available. Check via web interface at System Maintenance > Firmware InformationVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.4.4📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Multiple failed authentication attempts followed by successful login
- Unexpected system function calls
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting router compromise
- Anomalous management interface access
SIEM Query:
Search for: 'mainfunction.cgi' AND 'doPPPoE' AND 'table' in web server logs