Overview

In December 2024, a critical vulnerability, identified as CVE-2024-12987, was discovered in DrayTek Vigor2960 and Vigor300B routers running firmware version 1.5.1.5. This vulnerability allows remote attackers to execute arbitrary operating system commands via the web management interface, potentially compromising the entire network infrastructure.

Technical Details

Affected Devices:

• DrayTek Vigor2960 (Firmware v1.5.1.4)
• DrayTek Vigor300B (Firmware v1.5.1.4)

Vulnerability Type: OS Command Injection

Attack Vector: Remote via Web Management Interface

CVSS Scores:

• CVSS v3.1: 7.3 (High)
• CVSS v2.0: 7.5 (High)

The vulnerability resides in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint of the web management interface. Improper handling of the session parameter allows attackers to inject malicious commands, leading to unauthorized command execution on the device.

Exploitation and Impact

Public proof-of-concept (PoC) exploits for CVE-2024-12987 have been released, increasing the risk of exploitation. Security researchers have demonstrated how a simple HTTP POST request can be crafted to exploit the vulnerability, allowing attackers to execute commands like pwd to list directories or more malicious commands to manipulate device configurations.

Potential Impacts:

• Unauthorized Access: Attackers can gain control over the router, potentially accessing sensitive network configurations and data.
• Network Compromise: Compromised routers can be used as entry points to infiltrate internal networks, leading to broader security breaches.
• Service Disruption: Malicious commands can disrupt network services, leading to downtime and operational losses.

Mitigation Strategies

1. Firmware Update:
DrayTek has released firmware version 1.5.1.5 to address this vulnerability. Users should immediately update their devices to this version to mitigate the risk.

2. Access Control:

• Restrict access to the web management interface to trusted IP addresses.
• Implement strong authentication mechanisms to prevent unauthorized access.

3. Network Monitoring:

• Monitor network traffic for unusual activities that may indicate exploitation attempts.
• Use intrusion detection systems (IDS) to detect and alert on suspicious behaviors.

SecurityHive's Vulnerability Management Solution

To proactively manage and mitigate such vulnerabilities, SecurityHive offers a comprehensive Vulnerability Management solution.

Key Features:

• Continuous Monitoring: Automated scanning of network devices to identify known vulnerabilities like CVE-2024-12987.
• Risk Assessment: Prioritize vulnerabilities based on severity and potential impact to focus remediation efforts effectively.
• Patch Management: Track and manage firmware updates across all devices to ensure timely application of security patches.
• Compliance Reporting: Generate reports to demonstrate compliance with security standards and regulations.

Benefits:

• Reduced Risk Exposure: Early detection and remediation of vulnerabilities minimize the window of opportunity for attackers.
• Operational Efficiency: Automated processes reduce the manual effort required for vulnerability management.
• Enhanced Security Posture: Maintaining up-to-date devices and configurations strengthens overall network security.

Conclusion

CVE-2024-12987 poses a significant threat to organizations using DrayTek Vigor2960 and Vigor300B routers. Immediate action is required to update affected devices and implement robust security measures. Leveraging SecurityHive's Vulnerability Management solution can provide the necessary tools and insights to protect your network against such critical vulnerabilities.

Stay Protected with SecurityHive

Ensure your network's security by proactively managing vulnerabilities. Learn more about how SecurityHive's Vulnerability Management can safeguard your organization.

Discover SecurityHive Vulnerability Management

‍