erroneo.us
Search all guides⌘K

Security Digest · Dec 27, 2024 · Vulnerability · Network edge

DrayTek Vigor2960/300B CVE-2024-12987: Exploited Web UI RCE

Unauthenticated command injection in DrayTek Vigor2960, Vigor300B and Vigor3900 web management, in KEV. Fixed in 1.5.1.5; 1.5.1.8 is current. Check old units.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Vigor2960, Vigor300B and Vigor3900 routers on firmware 1.5.1.5 or later are fixed; any unit still on 1.5.1.4 or older with its web management reachable from the internet should be upgraded today and checked for tampering.

Who must act: Owners of DrayTek Vigor2960, Vigor300B or Vigor3900 routers on firmware below 1.5.1.5, most urgently where the web management interface faces the internet.

Who can relax: Owners of other DrayTek models, which this CVE does not name, and of these three models already on 1.5.1.5 or newer with management limited to the LAN or a VPN.

Affected
DrayTek Vigor2960 firmware 1.5.1.4 (older builds not addressed; assume affected)
DrayTek Vigor300B firmware 1.5.1.4 (older builds not addressed; assume affected)
DrayTek Vigor3900 before 1.5.1.5 (named by CISA and DrayTek's release notes)
Fixed in
Firmware 1.5.1.5 for Vigor2960, Vigor300B and Vigor3900
Current release for all three: 1.5.1.8 (October 2026)
CVSS
9.8 (v3.1, NVD)
EPSS
98.2% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every Vigor2960, Vigor300B and Vigor3900 and note its firmware version.
  2. Before upgrading, change any admin password that contains a % character, as DrayTek's release notes warn.
  3. Upgrade to 1.5.1.8, or at least 1.5.1.5, and verify the image against the FIRMWARE.DIGESTS file.
  4. Allow web management only from the LAN or a management VPN; remove any WAN-side access.
  5. If the interface was internet-facing on old firmware, review admin users, VPN profiles, NAT and DNS settings, and factory-reset if in doubt.

How to check if you are affected or compromised

  • Search reverse-proxy, IDS or firewall logs for requests to /cgi-bin/mainfunction.cgi/apmcfgupload, especially with shell metacharacters in the session parameter.
  • Also search for /cgi-bin/mainfunction.cgi/cvmcfgupload, the path of the older KEV-listed CVE-2020-15415 in the same models.
  • Check the router for admin accounts, VPN users, port forwards or DNS servers you did not configure.
  • Look for unexpected outbound connections from the router's WAN address in NetFlow or upstream firewall logs.

What happened#

On December 27, 2024, a CVE record from VulDB disclosed an OS command injection in the web management interface of DrayTek Vigor2960 and Vigor300B on firmware 1.5.1.4. The bug sits in /cgi-bin/mainfunction.cgi/apmcfgupload, where manipulating the session argument injects OS commands. The record says the attack works remotely, an exploit was already public, and firmware 1.5.1.5 fixes it. VulDB scored it CVSS 3.1 7.3. NVD rates it 9.8, as unauthenticated remote code execution.

CISA added the CVE to the KEV catalog on May 15, 2025, with a June 5 deadline. It pointed to DrayTek's 1.5.1.5 release notes for the Vigor2960, Vigor300B and Vigor3900. Each is marked "Critical - Upgrade immediately" and lists "Improve Web GUI Security (CVE-2024-12987)." DrayTek's firmware server dates the 1.5.1.5 images to October 2023 and the CVE-annotated notes to May 9, 2025, so the fix shipped over a year before the CVE existed.

CISA has not said what exploitation prompted the listing. CrowdSec has tracked exploit attempts against the endpoint since June 2025. It describes the attackers as a mix of opportunistic scanners and targeted actors.

Who is affected#

The CVE record names Vigor2960 and Vigor300B 1.5.1.4. CISA and DrayTek's notes add the Vigor3900, which shares the firmware line. The record does not address older builds, so treat anything below 1.5.1.5 as vulnerable. DrayTek still ships firmware for all three: 1.5.1.8, posted in October 2026, is current. These are VPN routers that typically sit at a site's internet edge. They also have history. CISA lists two earlier code-execution bugs in the same three models, CVE-2020-8515 and CVE-2020-15415. DrayTek's advisories covered the second in June 2020.

Do you really need to act?#

Most owners who have updated in the past three years are already fixed, since 1.5.1.5 and three later builds are out. The risk is the router nobody has touched since 1.5.1.4 (May 2022, per DrayTek's server), especially with its web interface open for remote admin. On that box an unauthenticated attacker gets command execution on the device that terminates your VPNs, using exploit code public since disclosure. Upgrade it today and check it.

What to do now#

  1. Note each unit's firmware version in its web interface, and check the latest build with curl -s https://fw.draytek.com.tw/Vigor2960/Firmware/latest.txt (swap in Vigor300B or Vigor3900).
  2. Before upgrading, change any admin password containing %. The release notes say 1.5.1.4 and later reject it, and give a Telnet/SSH fallback: enable, configure system, admin_passwd.
  3. Upgrade to 1.5.1.8, or at least 1.5.1.5. Compare shasum -a 1 Vigor2960_v1.5.1.8.zip with the FIRMWARE.DIGESTS file in the same folder.
  4. Allow web management only from the LAN or a management VPN, and remove any WAN-side access.
  5. If the interface faced the internet on old firmware, export the config and review admin users, VPN profiles, NAT rules and DNS settings. Factory-reset if anything looks wrong.

How to tell if you were hit#

CrowdSec says exploitation targets /cgi-bin/mainfunction.cgi/apmcfgupload with a manipulated session parameter. Search reverse-proxy, IDS or firewall logs for that path, and for cvmcfgupload, the CVE-2020-15415 path, in case the same scanners tried both. Then check the router itself for configuration you did not make: new admin or VPN accounts, port forwards, or changed DNS servers. Look for outbound connections from its WAN address to unfamiliar hosts. Treat a unit that was exposed while unpatched as untrusted until it is reset and upgraded.

Timeline#

  • — Firmware 1.5.1.5 images are posted on DrayTek's firmware server, per its file dates.
  • — CVE-2024-12987 is published, with a public exploit write-up.
  • — DrayTek reissues the 1.5.1.5 release notes naming the CVE.
  • — CISA adds the CVE to KEV, with a June 5 federal deadline.
  • — CrowdSec begins tracking exploit attempts.
  • — Firmware 1.5.1.8, the current build, is posted.

Vulnerability records

  • CVE-2024-12987 · KEV 2025-05-15 · A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. DrayTek — Vigor2960 firmware 1.5.1.5 release note fw.draytek.com.tw
  2. DrayTek — Vigor300B firmware 1.5.1.5 release note fw.draytek.com.tw
  3. DrayTek — Vigor3900 firmware 1.5.1.5 release note fw.draytek.com.tw
  4. DrayTek — Vigor2960 firmware index fw.draytek.com.tw
  5. CVE record — CVE-2024-12987 cve.org
  6. NVD — CVE-2024-12987 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2024-12987 cisa.gov
  8. DrayTek UK — Security advisories draytek.co.uk
  9. CrowdSec — CVE-2024-12987 tracker tracker.crowdsec.net