CVE-2022-50994: DrayTek Vigor 2960 RCE Vulnerability

CVE-2022-50994 Overview

CVE-2022-50994 is an OS command injection vulnerability [CWE-78] affecting DrayTek Vigor 2960 firmware versions prior to 1.5.1.4. The flaw resides in the CGI login handler, which passes unsanitized input from the formpassword parameter to the otp_check.sh shell script. Unauthenticated remote attackers can inject shell metacharacters to execute arbitrary commands with web server privileges. Exploitation requires knowledge of a valid username and that the target account has Mobile One-Time Password (MOTP) authentication enabled. DrayTek released firmware 1.5.1.4 to address the issue, though the Vigor 2960 platform has reached end-of-life status.

Critical Impact

Unauthenticated remote command execution on edge router devices, providing attackers with a foothold for lateral movement into internal networks.

Affected Products

• DrayTek Vigor 2960 firmware versions prior to 1.5.1.4
• DrayTek Vigor 2960 (end-of-life product line)
• Deployments with MOTP authentication enabled on user accounts

Discovery Timeline

• 2026-05-08 - CVE-2022-50994 published to NVD
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2022-50994

Vulnerability Analysis

The vulnerability resides in the mainfunction.cgi login handler on the Vigor 2960 web management interface. When a client submits credentials, the handler forwards the formpassword field to the otp_check.sh shell script for MOTP validation. The script invokes the password value within a shell context without sanitization or argument escaping. Attackers can append shell metacharacters such as ;, |, $(), or backticks to break out of the intended command and execute arbitrary operating system commands. Successful exploitation yields code execution as the user running the web server, typically a privileged account on embedded networking devices.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The CGI handler treats user-supplied authentication input as trusted data and concatenates it into a shell command line. No input validation, allowlist filtering, or use of parameterized execution APIs is performed before the value is passed to /bin/sh.

Attack Vector

Exploitation occurs over the network against the device's HTTP or HTTPS management interface. The attacker must know a valid username and that the account has MOTP authentication enabled, which raises attack complexity. No prior authentication is required because the injection occurs during the pre-authentication credential validation path. Devices exposing the management interface to the internet are at greatest risk.

The exploitation mechanism involves submitting a crafted POST request to the login endpoint with shell metacharacters embedded in the formpassword parameter. When otp_check.sh processes the value, the injected command executes alongside the intended password check. See the VulnCheck Advisory on DrayTek Vulnerability for additional technical analysis.

Detection Methods for CVE-2022-50994

Indicators of Compromise

• HTTP or HTTPS POST requests to mainfunction.cgi containing shell metacharacters such as ;, |, &, $(, or backticks within the formpassword field
• Unexpected outbound connections from the router to attacker-controlled infrastructure following login attempts
• Anomalous child processes spawned by the web server or by otp_check.sh on the device
• Modifications to device configuration, firewall rules, or DNS settings without administrative action

Detection Strategies

• Inspect web server and CGI access logs for login requests containing non-printable or shell-special characters in password fields
• Correlate failed authentication events with outbound network traffic from the router's management plane
• Monitor for unauthorized administrative configuration changes on Vigor 2960 devices

Monitoring Recommendations

• Forward router syslog and authentication logs to a centralized log analytics platform for retention and correlation
• Alert on any management interface access originating from untrusted networks or geographies
• Track firmware versions across the device fleet to identify systems still running pre-1.5.1.4 builds

How to Mitigate CVE-2022-50994

Immediate Actions Required

• Update DrayTek Vigor 2960 firmware to version 1.5.1.4 or later using the DrayTek Firmware Release Notes
• Restrict access to the web management interface to trusted internal networks only and disable WAN-side administration
• Audit user accounts to identify which have MOTP authentication enabled, since these are the exploitable accounts
• Plan migration away from the Vigor 2960 platform, which has reached end-of-life per the DrayTek End-of-Life Notification

Patch Information

DrayTek addressed the OS command injection in Vigor 2960 firmware version 1.5.1.4. The patch sanitizes input passed to the otp_check.sh script. Because the Vigor 2960 line is end-of-life, no further security updates are guaranteed. Organizations should treat firmware 1.5.1.4 as the terminal supported release and plan hardware replacement.

Workarounds

• Disable MOTP authentication on all accounts until firmware is updated, since exploitation requires MOTP-enabled accounts
• Place the management interface behind a VPN and block direct internet exposure of TCP/443 and TCP/80 on the router
• Apply ACLs that limit management plane access to a defined administrator workstation subnet
• Replace end-of-life Vigor 2960 devices with vendor-supported hardware as a long-term remediation