Threats tagged 'ghsa-6vqp-3x8r-9qrr'

A critical command injection vulnerability exists in DrayTek Vigor2960 devices running firmware up to version 1.5.1.6. The flaw is in the sub_14914 function of /cgi-bin/mainfunction.cgi, where manipulation of the swmconfigupload argument allows remote attackers to execute arbitrary commands. Public exploit code has been disclosed. Upgrading to version 1.5.1.7 resolves the issue.