CVE-2024-45882

Summary

CVE-2024-45882 is a command injection vulnerability affecting DrayTek Vigor3900 devices running version 1.5.1.3 of their firmware. By setting the `action` parameter in `cgi-bin/mainfunction.cgi` to `delete_map_profile,` an attacker can inject and execute arbitrary commands on the targeted device. This vulnerability poses a significant risk, as an unauthorized user could exploit it to gain control over the device or steal sensitive information. Device owners are strongly advised to update their firmware as soon as a patch becomes available to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.