CVE-2024-45890

Summary

CVE-2024-45890 is a post-authentication command injection vulnerability affecting DrayTek Vigor3900 devices running firmware version 1.5.1.3. The issue lies within the `cgi-bin/mainfunction.cgi` file, specifically the `action` parameter set to `download_ovpn`. An attacker who has already gained access to the system can exploit this flaw to inject and execute arbitrary commands, potentially leading to unauthorized system access or data theft.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.