CVE-2024-12987 MEDIUM

CVE-2024-12987: DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection

Vendor Draytek
Product Vigor2960
Weakness CWE-78
KEV Status Known Exploited
Published December 27, 2024
Last update October 21, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

December 27, 2024 CVE published
October 21, 2025 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-12987 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html CISA KEV Reference https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.5/DrayTek_… CISA KEV Reference https://fw.draytek.com.tw/Vigor300B/Firmware/v1.5.1.5/DrayTek_… CISA KEV Reference https://fw.draytek.com.tw/Vigor3900/Firmware/v1.5.1.5/DrayTek_… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2024-12987