CVE-2024-12986: Draytek Vigor300b Firmware RCE Vulnerability

CVE-2024-12986 Overview

A critical OS command injection vulnerability has been identified in DrayTek Vigor2960 and Vigor300B enterprise gateway devices. The vulnerability exists in the Web Management Interface, specifically within the /cgi-bin/mainfunction.cgi/apmcfgupptim endpoint. An unauthenticated remote attacker can exploit this flaw by manipulating the session argument, enabling arbitrary operating system command execution on the affected device.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands on vulnerable DrayTek gateway devices, potentially leading to complete device compromise, network infiltration, and persistent access to enterprise network infrastructure.

Affected Products

• DrayTek Vigor2960 Firmware versions 1.5.1.3 and 1.5.1.4
• DrayTek Vigor300B Firmware versions 1.5.1.3 and 1.5.1.4
• All hardware variants of DrayTek Vigor2960 and Vigor300B running vulnerable firmware

Discovery Timeline

• 2024-12-27 - CVE-2024-12986 published to NVD
• 2025-05-28 - Last updated in NVD database

Technical Details for CVE-2024-12986

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection). The flaw resides in the apmcfgupptim endpoint within the DrayTek Web Management Interface, which fails to properly sanitize user-supplied input before incorporating it into OS-level commands.

The attack is network-accessible without requiring prior authentication or user interaction. When exploited, attackers can inject malicious commands through the session parameter, which are then executed with the privileges of the web server process—typically root on embedded devices like these enterprise gateways.

DrayTek Vigor2960 and Vigor300B are multi-WAN load balancing VPN routers commonly deployed in enterprise and SMB environments, making this vulnerability particularly concerning for organizations relying on these devices as network edge security appliances.

Root Cause

The root cause stems from insufficient input validation in the /cgi-bin/mainfunction.cgi/apmcfgupptim handler. The session argument is passed directly to system-level functions without proper sanitization or escaping. This allows special characters and command sequences to be interpreted as shell commands rather than treated as literal data.

The vulnerability follows a classic command injection pattern where user-controllable input is concatenated into a command string that is subsequently executed by the underlying operating system shell.

Attack Vector

The attack can be initiated remotely over the network against the Web Management Interface. Key characteristics of the attack vector include:

• Network-based exploitation: Attackers can reach the vulnerable endpoint from any network location with access to the management interface
• No authentication required: The vulnerable endpoint does not require valid credentials
• No user interaction needed: Exploitation is fully automated without requiring victim interaction
• Direct command execution: Injected commands execute immediately upon request processing

The exploitation involves crafting HTTP requests to the vulnerable CGI endpoint with specially crafted session parameter values containing OS command injection payloads. For detailed technical analysis of the command injection mechanism, refer to the NetSecFish Command Injection Analysis.

Detection Methods for CVE-2024-12986

Indicators of Compromise

• Unusual HTTP requests to /cgi-bin/mainfunction.cgi/apmcfgupptim containing shell metacharacters (;, |, $(), backticks) in the session parameter
• Unexpected outbound network connections from the DrayTek device to external IP addresses
• Modified system files, unexpected user accounts, or new cron jobs on the affected device
• Abnormal process activity or resource consumption on the gateway appliance

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing command injection patterns targeting the apmcfgupptim endpoint
• Deploy network intrusion detection signatures matching exploitation attempts against DrayTek CGI endpoints
• Monitor authentication logs and system logs on DrayTek devices for anomalous activity patterns
• Utilize SentinelOne Singularity XDR for endpoint-level detection of post-exploitation behavior on connected systems

Monitoring Recommendations

• Enable comprehensive logging on DrayTek devices and forward logs to a centralized SIEM for correlation and analysis
• Establish baseline network traffic patterns for management interface access and alert on deviations
• Implement regular automated scanning to detect vulnerable firmware versions across your DrayTek device inventory
• Monitor for DNS queries or network connections to known malicious infrastructure from gateway devices

How to Mitigate CVE-2024-12986

Immediate Actions Required

• Upgrade all DrayTek Vigor2960 and Vigor300B devices to firmware version 1.5.1.5 or later immediately
• Restrict access to the Web Management Interface to trusted administrative networks only using firewall rules
• If immediate patching is not possible, disable remote management access until the update can be applied
• Audit device configurations for signs of compromise and reset to factory defaults if tampering is detected

Patch Information

DrayTek has released firmware version 1.5.1.5 which addresses this command injection vulnerability. Organizations should obtain the updated firmware directly from the official DrayTek support portal and verify firmware integrity before deployment. The upgrade process can typically be performed through the Web Management Interface under System Maintenance > Firmware Upgrade.

Additional technical details and vulnerability tracking information are available through VulDB #289379.

Workarounds

• Configure access control lists (ACLs) to restrict Web Management Interface access exclusively to trusted administrator IP addresses or subnets
• Implement network segmentation to isolate management plane traffic from general network access
• Deploy an upstream firewall or WAF to filter malicious requests targeting the vulnerable endpoint
• Consider temporarily disabling the Web Management Interface and using console access for administration until patching is complete

# Example: Restrict management access to specific admin subnet
# Configure firewall rules on upstream device or DrayTek ACL
# Allow management access only from 10.0.10.0/24 admin network
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP