OS Command Injection in DrayTek Vigor Routers (CVE-2024-12987)

Historical catalog analysis: CISA added this entry on May 15, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-12987 is an OS command injection vulnerability (CWE-78) identified in the web management interface of specific DrayTek Vigor routers. The flaw exists within a function of the /cgi-bin/mainfunction.cgi/apmcfgupload file. This type of vulnerability typically allows an attacker to execute arbitrary operating system commands on the target device if they can successfully inject malicious input into the affected component.

Exposure and applicability

This vulnerability applies specifically to the following DrayTek Vigor router models:
* Vigor2960
* Vigor300B
* Vigor3900

Exposure is highest for organizations that have these models deployed with the web management interface accessible over untrusted networks. Because the vulnerability resides in a CGI script used for configuration uploads, any asset running an affected firmware version on these specific hardware models is potentially susceptible.

Remediation priorities

Our analysis suggests prioritizing remediation based on the accessibility of the management interface and the criticality of the network segment the router protects.

1. Firmware Update: The primary corrective action is to apply the firmware updates specified in the vendor’s release notes for the Vigor2960, Vigor300B, and Vigor3900 models.
2. Interface Restriction: As a compensating control, defenders should restrict access to the web management interface to trusted internal IP addresses or a dedicated management VLAN to reduce the likelihood of external exploitation.
3. Decommissioning: If firmware updates are unavailable for a specific legacy device in use, our analysis recommends discontinuing use of the product to eliminate the exposure path.

How to validate remediation

To verify that the risk has been reduced, vulnerability management teams should perform the following checks:
* Version Verification: Confirm that the installed firmware version matches or exceeds the versions listed in the vendor’s official release notes for the respective model.
* Configuration Audit: Verify that the web management interface is not exposed to the public internet and is restricted via Access Control Lists (ACLs).

It is important to note that a version check alone confirms the update was applied, but it does not functionally prove the vulnerability is mitigated in the specific environment. Validation should include confirming that the /cgi-bin/mainfunction.cgi/apmcfgupload component no longer accepts unauthorized or malformed input as intended by the patch.

Limits and open questions

There are several unknowns regarding this vulnerability. The source indicates that the specific function within the apmcfgupload file causing the injection is unknown. Additionally, it is currently unknown whether this vulnerability has been utilized in known ransomware campaigns.

Residual risk remains if management interfaces are left exposed to internal threats or if administrative credentials have been compromised, as these could provide the necessary access to reach the vulnerable component regardless of network perimeter controls.

Source and editorial note

CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability · Source date: May 15, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 18, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 14, 2026 at 00:45 UTC.

Request a Vulnerability Assessment