Critical severity9.8NVD Advisory· Published Oct 14, 2024· Updated Jun 17, 2026

CVE-2024-48153

Description

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.

Affected products

Draytek/Vigor3900llm-fuzzy2 versions
1.5.1.3+ 1 more
- (no CPE)range: 1.5.1.3
- (no CPE)
Draytek/Vigor3900 Firmware
cpe:2.3:o:draytek:vigor3900_firmware:1.5.1.3:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

github.com/tw11ty/CVE/blob/main/DrayTek/Vigor3900/Vigor3900%20command%20execution%20vulnerability.mdnvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000