CVE-2024-44844: Draytek Vigor3900 Firmware RCE Vulnerability

CVE-2024-44844 Overview

CVE-2024-44844 is an authenticated command injection vulnerability affecting DrayTek Vigor3900 routers running firmware version 1.5.1.6. The flaw resides in the run_command function, where the name parameter is passed to an underlying shell without proper sanitization. An authenticated attacker with low privileges can inject arbitrary operating system commands over the network. Successful exploitation results in complete compromise of the router, including confidentiality, integrity, and availability of the device. The vulnerability is tracked under [CWE-78] OS Command Injection and [CWE-77] Command Injection.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the Vigor3900, gaining full control of the router and pivoting into the internal network.

Affected Products

DrayTek Vigor3900 (hardware)
DrayTek Vigor3900 Firmware version 1.5.1.6
Deployments exposing the management interface to untrusted networks

Discovery Timeline

2024-09-06 - CVE-2024-44844 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44844

Vulnerability Analysis

The DrayTek Vigor3900 exposes a web management interface that handles administrative commands through internal handler functions. One such handler, run_command, accepts a name parameter supplied by the authenticated user. The handler concatenates this parameter into a shell command string that is then executed by the underlying operating system.

Because the name value is not filtered or escaped, an attacker can append shell metacharacters such as ;, |, or backticks to break out of the intended command context. The injected payload executes with the privileges of the web management process, which typically runs as root on embedded routers. This grants the attacker persistent access to the device firmware, configuration, and connected network segments.

Root Cause

The root cause is missing input validation on the name parameter within run_command. The function trusts user-controlled data and passes it directly to a shell interpreter. This pattern violates the principle of separating code from data and maps directly to [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

Exploitation requires network access to the management interface and valid credentials for any account permitted to reach the vulnerable endpoint. The attacker submits a crafted HTTP request in which the name parameter carries a shell payload appended to a legitimate value. The router parses the request, invokes run_command, and executes the injected commands. Refer to the GitHub IoT Vulnerability Report for a technical walkthrough.

No public proof-of-concept exploit is listed on ExploitDB, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 1.902% (77.8 percentile), indicating measurable interest relative to other CVEs.

Detection Methods for CVE-2024-44844

Indicators of Compromise

HTTP requests to the Vigor3900 management interface where the name parameter contains shell metacharacters such as ;, &&, |, $(, or backticks.
Unexpected outbound connections from the router to attacker-controlled infrastructure following administrative logins.
Unauthorized changes to router configuration, firewall rules, DNS settings, or administrative accounts.
New or modified processes on the device that do not correspond to the vendor firmware baseline.

Detection Strategies

Inspect web server and management logs on the Vigor3900 for requests invoking run_command with anomalous name values.
Correlate administrative authentication events with subsequent configuration changes to identify abuse of low-privilege accounts.
Deploy network intrusion detection signatures that flag command-injection metacharacters in DrayTek management HTTP parameters.

Monitoring Recommendations

Forward router syslog and authentication events to a centralized SIEM for retention and correlation.
Alert on administrative logins originating from unexpected geolocations or non-management VLANs.
Monitor egress traffic from the router itself, since a compromised device may initiate reverse shells or beaconing.

How to Mitigate CVE-2024-44844

Immediate Actions Required

Restrict access to the Vigor3900 management interface to trusted management networks only, using ACLs or a dedicated management VLAN.
Rotate all administrator and operator credentials on affected devices, and disable unused accounts.
Audit configuration, firewall rules, and DNS settings for unauthorized changes introduced through the vulnerability.
Contact DrayTek support to confirm the latest firmware version and available fixes for Vigor3900 running 1.5.1.6.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry for CVE-2024-44844. Administrators should consult the DrayTek security portal for firmware updates that supersede version 1.5.1.6 and apply them as soon as they are released. Until a fixed firmware version is available, treat all Vigor3900 devices running 1.5.1.6 as at risk from any account with management access.

Workarounds

Disable remote management on WAN interfaces and require VPN access for administrative sessions.
Enforce strong, unique credentials and multi-factor authentication for any administrative access path that supports it.
Segment the router management plane from user and server networks to limit blast radius if the device is compromised.
Consider replacing end-of-support Vigor3900 units with currently supported hardware if the vendor does not publish a firmware fix.

bash

# Example: restrict management access to a trusted subnet on an upstream firewall
iptables -A FORWARD -s 10.10.0.0/24 -d <vigor3900_ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <vigor3900_ip> -p tcp --dport 443 -j DROP