CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability

CVE-2024-12987 is an OS command injection vulnerability affecting certain DrayTek Vigor routers. It exists in the web management interface and can allow an attacker who can reach that interface to run operating-system commands on the device. Because these routers often sit at network edges and handle traffic for many hosts, successful abuse can give an attacker a foothold for further movement, configuration changes, or traffic interception. Confirm exact impact and affected firmware against the vendor advisory.

CISA lists the issue against DrayTek Vigor2960, Vigor300B, and Vigor3900 models and directs organizations to apply vendor mitigations or discontinue use if mitigations are unavailable. Ransomware use is not documented for this CVE.

How it works

The weakness is classified as CWE-78 (OS Command Injection). In this class of flaw, user-controlled input reaches a system command interpreter without proper sanitization or parameterization. An attacker who can interact with the vulnerable endpoint can craft input that the device treats as part of a shell command, allowing arbitrary command execution under the privileges of the web-management process.

According to the CISA summary, the issue is tied to an unknown function in the file path /cgi-bin/mainfunction.cgi/apmcfgupload within the web management interface of the listed Vigor models. No further exploit mechanics are provided here; defenders should treat any unauthenticated or weakly authenticated access to that CGI endpoint as high risk and verify details in the vendor advisory rather than assuming specific payloads or authentication requirements.

Am I affected? How to find it in your systems

The vulnerability is reported against DrayTek Vigor2960, Vigor300B, and Vigor3900 routers. These devices commonly appear as edge or branch routers, VPN gateways, or small-to-medium business firewalls. Inventory steps:

• Query asset-management, network-discovery, or configuration-management databases for DrayTek Vigor models, especially the three listed above.
• Scan internal and external IP ranges for open HTTP/HTTPS management ports and identify devices serving DrayTek web interfaces or the path containing mainfunction.cgi.
• Review firmware version strings on each device’s status or system-information page; compare them against the fixed versions named in the vendor advisory (do not rely on version numbers not present in that advisory).
• Check whether the web management interface is reachable from untrusted networks; exposure of the management plane is a common prerequisite for this class of attack.

Telemetry that may indicate probing or exploitation includes unusual POST or GET requests to /cgi-bin/mainfunction.cgi/apmcfgupload, unexpected process creation or shell activity on the router, sudden configuration changes, or outbound connections originating from the device itself. Correlate web-server logs (if retained) with firewall and NetFlow data. Confirm any indicators against the vendor advisory before treating them as definitive.

How to remediate

Patch first. Apply the mitigations or firmware updates supplied by DrayTek for the affected models, following the exact instructions in the vendor advisory. CISA’s required action is to apply those vendor mitigations, follow applicable BOD 22-01 guidance where cloud services are involved, or discontinue use of the product if mitigations are unavailable.

After updating:

• Re-verify the firmware version and confirm the vulnerable CGI function is no longer present or is properly sanitized.
• Restrict management-plane access to a dedicated, authenticated administrative network or jump host; disable remote web management if it is not required.
• Enforce strong authentication (and multi-factor where supported) on the management interface and rotate any credentials that may have been exposed.
• Harden the device by disabling unused services, enabling logging to a central SIEM, and applying any additional configuration guidance published by the vendor for this weakness class.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the routers so that the web management interface is reachable only from a tightly controlled administrative VLAN or jump host; block all other sources at the firewall.
• If the management interface cannot be fully isolated, place a web application firewall or reverse proxy in front of it and create rules that drop or challenge requests to /cgi-bin/mainfunction.cgi/apmcfgupload and similar CGI paths; treat this as virtual patching and re-evaluate after the real patch is installed.
• Disable the web management interface entirely if out-of-band or console access is available for administration.
• Increase monitoring: alert on any access to the management CGI paths, unexpected command execution artifacts, or configuration changes; retain logs long enough for forensic review.
• If mitigations remain unavailable, plan to replace or decommission the affected devices per CISA guidance.

If your data may have been exposed

Actively exploited edge-device vulnerabilities frequently lead to broader network compromise and data exposure. If these routers were reachable from untrusted networks and remained unpatched, treat any credentials, configuration data, or traffic that traversed them as potentially compromised. Rotate secrets, review logs for lateral movement, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts appear in public breach corpora.