CVE-2023-24229

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
draytek	vigor2960_firmware	1.5.1.4

References

Timeline

Published: Mar 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-24237.5A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event lo CVE-2023-242304.8A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute CVE-2023-242314.8A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management S CVE-2023-242324.8A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management Syst CVE-2023-242334.8A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management CVE-2023-242344.8A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System CVE-2023-242369.8TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/de CVE-2023-242389.8TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delSta CVE-2023-24248.8A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the CVE-2023-242419.8Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.CVE-2023-242437.5CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).CVE-2023-242497.2An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.