DrayTek Vigor2960 and Vigor300B Remote Command Injection Vulnerability Advisory (CVE-2024-12987)
Executive & SecOps Summary
SECOPS ASSESSMENTDrayTek Vigor2960 and Vigor300B gateway devices running firmware version 1.5.1.4 or prior
Unauthenticated remote attackers can execute arbitrary OS commands with root privileges via the Web Management Interface, leading to full system compromise
Immediately upgrade to firmware version 1.5.1.5 or higher and disable WAN-side web management access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
It is highly recommended to upgrade the affected devices to firmware version 1.5.1.5 or later immediately. Use the following reference commands or perform the upgrade via the Web UI ('System Maintenance -> Firmware Upgrade').
# 1. Verify the current firmware version of the device
sys version
# 2. Download and apply the secure firmware version (v1.5.1.5 or higher) from the official DrayTek repository
# (Manual upgrade via the Web GUI is recommended for stability)2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the web management interface from the WAN side to mitigate remote exploitation attempts.
# Disable HTTP/HTTPS management access from the WAN interface via CLI
sys config
no management wan http
no management wan https
save
# Restrict management access to trusted IP addresses only using Access Control Lists (ACLs)3. Log Audit & IoC Verification Commands
Inspect the web server access logs for suspicious requests targeting the vulnerable endpoint containing shell metacharacters.
# Scan web server access logs for exploitation attempts targeting the apmcfgupload endpoint
grep -Ei 'apmcfgupload' /var/log/httpd/access_log | grep -E 'session=.*[%3b|%26|%60|\;|\&|\`]'
# Check for unexpected active shell processes running on the gateway
ps | grep -E 'sh|bash|ash' | grep -v 'grep'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical OS command injection vulnerability (CVE-2024-12987) has been identified in the Web Management Interface of DrayTek Vigor2960 and Vigor300B gateway devices. The root cause lies within the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint, which fails to properly sanitize and validate user-supplied input passed via the session parameter. Consequently, shell metacharacters injected into this parameter are executed directly by the underlying operating system shell.
2. Exploitation Mechanics & Attack Scenario
This vulnerability can be exploited remotely without any prior authentication. An attacker can execute the following steps to compromise a target device:
- Locate an internet-exposed DrayTek Vigor2960 or Vigor300B web management interface.
- Craft a malicious HTTP POST request targeting
/cgi-bin/mainfunction.cgi/apmcfgupload. - Inject arbitrary shell commands into the
sessionparameter using command separators such as semicolons (;), backticks (`), or pipes (|`). - Upon receiving the request, the vulnerable CGI binary executes the payload with root privileges, allowing the attacker to establish a reverse shell or download malicious binaries.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an immediate threat to enterprise networks. Successful exploitation allows complete control over the perimeter gateway. Attackers can leverage this foothold to perform lateral movement within the internal network, intercept sensitive network traffic, harvest VPN credentials, or enlist the compromised device into a botnet for DDoS campaigns.
Official Vendor Advisories & References
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
Frequently Asked SecOps Questions (CVE-2024-12987)
FAQQ1. How critical is CVE-2024-12987 and is it actively exploited in the wild?
CVE-2024-12987 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 98.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-12987?
Primary impacted vendors include draytek across vigor2960, vigor300b. Scope summary: DrayTek Vigor2960 and Vigor300B routers/gateways running firmware version 1.5.1.4 and below
Q3. What temporary mitigations or workarounds exist for CVE-2024-12987 before patching?
[Mitigation] Immediately upgrade to firmware version 1.5.1.5 or higher and disable WAN-side web management access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-12987
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (draytek)
View Category →WAVLINK WL-WN579A3-A Router Initial Setup Wizard Remote Command Injection Vulnerability (CVE-2026-120195) Security Advisory
[Affected Scope] WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4 and prior.
WAVLINK WL-WN530HG4B Router wapi.cgi Port Forwarding Remote Command Injection Vulnerability (CVE-2026-120197) Technical Advisory
[Affected Scope] WAVLINK WL-WN530HG4B router with firmware version M_V260724.
Wavlink WN579X3-D Router wapi.cgi Remote Command Injection Vulnerability (CVE-2026-120196) Analysis and Mitigation Guide
[Affected Scope] Wavlink WN579X3-D V250402 firmware version.
LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.