CVE-2024-12987: Draytek Vigor300b Firmware RCE Flaw

CVE-2024-12987 Overview

A critical OS command injection vulnerability was discovered in DrayTek Vigor2960 and Vigor300B network gateway devices running firmware version 1.5.1.4. The vulnerability exists in the Web Management Interface, specifically within the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. Improper handling of the session argument allows remote attackers to inject and execute arbitrary operating system commands on the affected device without authentication.

Critical Impact

This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Remote attackers can achieve full system compromise on affected DrayTek gateway devices, potentially gaining persistent access to network infrastructure.

Affected Products

• DrayTek Vigor2960 Firmware version 1.5.1.4
• DrayTek Vigor300B Firmware version 1.5.1.4
• DrayTek Vigor2960 Hardware
• DrayTek Vigor300B Hardware

Discovery Timeline

• 2024-12-27 - CVE-2024-12987 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2024-12987

Vulnerability Analysis

This vulnerability is classified as CWE-77: Command Injection, which occurs when an application constructs system commands using user-supplied input without proper sanitization. In the context of DrayTek gateway devices, the apmcfgupload CGI endpoint processes the session parameter in an unsafe manner, allowing attackers to inject shell metacharacters and arbitrary commands that are then executed with the privileges of the web server process.

Network gateway devices like the Vigor2960 and Vigor300B are high-value targets because they often sit at the perimeter of enterprise networks, making them ideal pivot points for further intrusion. The exploit has been publicly disclosed, significantly increasing the risk of widespread exploitation.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the mainfunction.cgi script. When processing the session argument in the apmcfgupload function, the firmware fails to properly escape or validate user input before incorporating it into system command execution. This allows shell metacharacters such as semicolons, pipes, or backticks to break out of the intended command context and execute attacker-controlled commands.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can remotely target the Web Management Interface of vulnerable DrayTek devices by sending specially crafted HTTP requests to the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. By manipulating the session parameter with OS command injection payloads, attackers can execute arbitrary commands on the underlying Linux-based operating system.

The vulnerability allows attackers to perform actions such as downloading and executing malware, establishing reverse shells, modifying device configurations, intercepting network traffic, or using the compromised device as a launching point for attacks against internal network resources.

Detection Methods for CVE-2024-12987

Indicators of Compromise

• Unexpected HTTP requests to /cgi-bin/mainfunction.cgi/apmcfgupload with suspicious characters in the session parameter (semicolons, pipes, backticks, $() patterns)
• Unusual outbound connections from DrayTek devices to unknown IP addresses
• Unexpected processes spawned by the web server or CGI handlers on the device
• Modifications to device configuration files or firmware outside of normal administrative activities
• Evidence of reverse shell connections or command-and-control beaconing originating from gateway devices

Detection Strategies

• Implement network-based intrusion detection rules to identify HTTP requests containing command injection patterns targeting the apmcfgupload endpoint
• Deploy web application firewall (WAF) rules to filter requests with shell metacharacters in CGI parameters
• Monitor and alert on firmware version discrepancies across DrayTek device fleet using asset management tools
• Review web server access logs on DrayTek devices for anomalous request patterns to CGI endpoints

Monitoring Recommendations

• Enable detailed logging on DrayTek devices and forward logs to a centralized SIEM for correlation and analysis
• Establish baseline network behavior for gateway devices and alert on deviations such as unexpected outbound connections
• Conduct regular vulnerability scans of network infrastructure devices to identify unpatched firmware
• Monitor CISA KEV catalog updates and threat intelligence feeds for indicators related to DrayTek exploitation campaigns

How to Mitigate CVE-2024-12987

Immediate Actions Required

• Upgrade all affected DrayTek Vigor2960 and Vigor300B devices to firmware version 1.5.1.5 or later immediately
• Restrict access to the Web Management Interface to trusted IP addresses only using firewall rules or device ACLs
• Disable remote management access from the internet if not strictly required
• Conduct forensic review of potentially compromised devices to identify signs of exploitation before patching
• Isolate suspected compromised devices from the network pending investigation

Patch Information

DrayTek has released firmware version 1.5.1.5 which addresses this command injection vulnerability. Organizations should download and apply the patched firmware from official DrayTek resources:

• DrayTek Vigor2960 Release Notes - Contains details on security fixes for the Vigor2960 platform
• DrayTek Vigor300B Release Notes - Contains details on security fixes for the Vigor300B platform

Additional technical analysis is available from the NetSecFish Command Injection Analysis and the CISA Known Exploited Vulnerability entry for CVE-2024-12987.

Workarounds

• Implement IP-based access control lists (ACLs) to restrict Web Management Interface access to authorized management networks only
• Place DrayTek devices behind an additional firewall or VPN gateway that requires authentication before accessing the management interface
• Disable the Web Management Interface entirely if command-line or console-based management is acceptable for your environment
• Deploy network segmentation to limit lateral movement potential if a gateway device is compromised

# Example: Restrict management access via firewall rules
# Block external access to DrayTek management interface (port 443/80)
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.0.0/8 -j DROP
iptables -A INPUT -p tcp --dport 80 -s ! 10.0.0.0/8 -j DROP

# Allow only specific management subnet
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT