OS command injection in DrayTek Corp. products - CVE-2024-41585
Published: October 3, 2024
Vulnerability identifier: #VU97986
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-41585
CWE-ID: CWE-78
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: DrayTek Corp.
Affected software:
Vigor 1000B
Vigor 2962
Vigor 3910
Vigor 3912
Vigor 165
Vigor 166
Vigor 2135
Vigor 2763
Vigor 2765
Vigor 2766
Vigor 2865
Vigor 2866
Vigor 2915
Vigor 2620
Vigor LTE200
Vigor 2133
Vigor 2762
Vigor 2860
Vigor 2925
Vigor 2862
Vigor 2926
Vigor 2952
Vigor 3220
Vigor 2832
Vigor 1000B
Vigor 2962
Vigor 3910
Vigor 3912
Vigor 165
Vigor 166
Vigor 2135
Vigor 2763
Vigor 2765
Vigor 2766
Vigor 2865
Vigor 2866
Vigor 2915
Vigor 2620
Vigor LTE200
Vigor 2133
Vigor 2762
Vigor 2860
Vigor 2925
Vigor 2862
Vigor 2926
Vigor 2952
Vigor 3220
Vigor 2832
Detailed vulnerability description
The vulnerability allows a malicious guest to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the recvCmd binary, used by the host OS for communicating with the guest OS. A malicious guest can pass specially crafted data to the binary and execute arbitrary OS commands on the host OS.
How to mitigate CVE-2024-41585
Install updates from vendor's website.