| Titolo | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated set_table JSONData Command Injection |
|---|
| Descrizione | The jsondata accepted by action=set_table is deeply parsed, and the sectiontype field reaches later UCI/shell command construction. The current PoC confirms command execution on the real device by setting apmd.general.codexpoc=hit.
Affected path(s):
POST /cgi-bin/mainfunction.cgi with action=set_table
Root cause:
The parsed jsondata.sectiontype value is inserted into command construction and reaches system() without shell-safe isolation.
Confirmed impact:
An authenticated attacker can inject arbitrary shell commands through jsondata and execute them with the CGI process privileges on the device. |
|---|
| Fonte | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection |
|---|
| Utente | eqqie (UID 101441) |
|---|
| Sottomissione | 19/09/2026 16:45 (1 mese fa) |
|---|
| Moderazione | 20/10/2026 07:50 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422665 [DrayTek Vigor2960 1.5.1.6 Revision 8218 CGI Process mainfunction.cgi set_table sectiontype escalationi di privilegi] |
|---|
| Punti | 20 |
|---|