Horizon Alert
Summary of the vulnerability and why it matters
This issue allows attackers to execute arbitrary commands on DrayTek Vigor 2960 network gateways. This could lead to unauthorized control and compromise of network security.
- Attackers can exploit this remotely.
- It impacts network gateways.
- Knowledge of a username is needed.
Attack Path
How an attacker could exploit the issue
An unauthenticated remote attacker could exploit this by sending specially crafted input to the login page. If successful, they could execute arbitrary commands on the device with web server privileges. This requires knowing a username and that MOTP authentication is enabled for that account.
- Targets unauthenticated remote attackers.
- Exploits CGI login handler.
- Requires valid username and MOTP.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on DrayTek Vigor 2960 devices. Attackers are likely to target this because it provides direct command execution on a device often exposed to the internet. However, exploitation requires knowledge of valid usernames and that MOTP authentication is enabled, which may limit widespread weaponization.
- Exploitation requires specific conditions.
- No public exploit code observed.
- No KEV listing signal.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching affected DrayTek Vigor 2960 devices to version 1.5.1.4 or later to address the critical OS command injection vulnerability. If immediate patching is not feasible, isolate these devices from the network and restrict access to authenticated users with MOTP enabled.
- Update firmware to 1.5.1.4 or newer.
- Isolate affected devices from network.
- Monitor for suspicious login attempts.
