CVE-2024-51246 is a command injection vulnerability identified in the Draytek Vigor3900 router firmware version 1.5.1.3. The flaw resides in the handling of requests to the mainfunction.cgi endpoint, specifically within the doPPTP function. An attacker with low privileges and network access can craft malicious input that is improperly sanitized, allowing arbitrary command execution on the underlying operating system. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 score is 8.0, reflecting high impact across confidentiality, integrity, and availability, with low attack complexity and no user interaction required. Exploitation requires some level of privilege (PR:L), but no authentication is explicitly stated as required, suggesting possible exploitation from authenticated or semi-authenticated sessions. The vulnerability could enable attackers to take full control of the device, disrupt network operations, intercept or manipulate traffic, and pivot to internal networks. No patches or public exploits have been reported at the time of publication, but the severity and nature of the flaw warrant immediate attention from affected organizations.

The vulnerability allows attackers to execute arbitrary commands on affected Draytek Vigor3900 routers, potentially leading to full device compromise. This can result in unauthorized access to sensitive network data, interception or manipulation of network traffic, disruption of network services, and use of the compromised device as a foothold for further attacks within an organization’s infrastructure. The impact spans confidentiality, integrity, and availability, making it a critical risk for enterprises relying on these routers for secure VPN and network management. Given the role of such routers in enterprise and ISP environments, exploitation could lead to widespread operational disruption and data breaches. The lack of known public exploits currently limits immediate widespread attacks, but the vulnerability’s characteristics make it a prime target for threat actors once exploit code becomes available.

1. Immediately restrict access to the router’s management interfaces (especially mainfunction.cgi) to trusted networks and IP addresses only, using firewall rules and access control lists. 2. Disable or restrict PPTP VPN functionality if not required, as the vulnerability is linked to the doPPTP function. 3. Monitor network traffic and device logs for unusual command execution patterns or unauthorized access attempts targeting mainfunction.cgi. 4. Apply firmware updates from Draytek as soon as they are released addressing CVE-2024-51246. 5. Implement network segmentation to limit the exposure of critical routers to untrusted networks. 6. Use multi-factor authentication and strong credentials for device management to reduce the risk of privilege escalation. 7. Conduct regular vulnerability assessments and penetration testing focusing on network infrastructure devices to detect similar issues proactively.