High severity7.8NVD Advisory· Published Mar 15, 2023· Updated Jun 17, 2026

CVE-2023-24229

Description

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Draytek/Vigor2960 Firmware
cpe:2.3:o:draytek:vigor2960_firmware:1.5.1.4:*:*:*:*:*:*:*
Draytek/Vigor2962llm-fuzzy2 versions
= 1.5.1.4+ 1 more
- (no CPE)range: = 1.5.1.4
- (no CPE)

Patches

Vulnerability mechanics

References

www.draytek.comnvdNot Applicable
web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vulnvd
www.draytek.co.uk/support/guides/kb-remotemanagementnvd
www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960nvd
www.draytek.com/support/knowledge-base/5465nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000