Read the docs
TI-2022-26435 Aliases CVE-2022-50994GHSA-ccr6-v597-2vp9

DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01432 73rd percentileScored 2026-11-07
Fix Fixed Vigor 2960 (DrayTek): 1.5.1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor 2960before 1.5.1.41.5.1.4Patch availableCNA
  • Vigor 2960 VendorDrayTek Affected before 1.5.1.4 Fixed in 1.5.1.4 Patch available CNA

Remediation

  • Fix · CNA Vigor 2960 (DrayTek) Fixed in 1.5.1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50994
  2. 2026-10-03 Alias added: GHSA-ccr6-v597-2vp9

References

Patch 1

Advisory 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences