CVE-2024-12987 DrayTek Vigor Routers OS Command Injection

Exploited in the wild Medium 6.9 Published 27 Dec 2024 Updated 21 Oct 2025

Remote attackers can execute arbitrary OS commands via the web management interface, requiring an upgrade to mitigate.

Exploited in the wild: Since 15 May 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-12987?

CVE-2024-12987 is a medium-severity command injection vulnerability in DrayTek Vigor2960, published on 27 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

Weakness: CWE-78, CWE-77

Which versions are affected by CVE-2024-12987?

It affects 2 products.

Products include Draytek Vigor2960 Firmware, Draytek Vigor300b Firmware.

How do I fix CVE-2024-12987?

No fix has been published for CVE-2024-12987 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Jun 2025.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-12987 being exploited?

Yes. Attackers have exploited CVE-2024-12987 in the wild since at least 15 May 2025.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-3mp3-6fg3-7hxj.