CVE-2024-45893

Summary

CVE-2024-45893 is a post-authentication command injection vulnerability affecting the DrayTek Vigor3900 with firmware version 1.5.1.3. The issue lies within the `mainfunction.cgi` script, specifically when the `action` parameter is set to `setSWMOption`. An attacker can exploit this vulnerability by injecting malicious commands, potentially leading to unauthorized system modifications or data exposure. Users are advised to update their firmware as soon as a patch is available to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.