High severity8.0NVD Advisory· Published Aug 21, 2024· Updated Jun 17, 2026

CVE-2024-43027

Description

DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi.

Affected products

Draytek/Vigor2960 Firmware
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Range: <1.5.1.5
Draytek/Vigor300b Firmware
cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*
Range: <1.5.1.5
Draytek/Vigor3900 Firmware
cpe:2.3:o:draytek:vigor3900_firmware:*:*:*:*:*:*:*:*
Range: <1.5.1.5
Draytek/Vigor3900cpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.5.1.5_Beta
Draytek/Vigor 2960llm-fuzzy
Range: <1.5.1.5_Beta
Draytek/Vigor 300Bllm-fuzzy
Range: <1.5.1.5_Beta

Patches

Vulnerability mechanics

References

github.com/N1nEmAn/wp/blob/main/V3900.mdnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000