CVE-2023-47254

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txtExploit, Third Party Advisory
https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023-023Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txtExploit, Third Party Advisory
https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023-023Third Party Advisory

Timeline

Published: Dec 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-472565.5ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings CVE-2023-472578.1ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.CVE-2023-472586.1Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.CVE-2023-472596.1Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.CVE-2023-47264.8The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including CVE-2023-472606.1Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.CVE-2023-472619.8Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request cont CVE-2023-472625.2The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical acce CVE-2023-472637.5Certain WithSecure products allow a Denial of Service (DoS) in the antivirus engine when scanning a fuzzed PE32 file. This affects WithSecur CVE-2023-472647.5Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of service (DoS). This aff CVE-2023-472655.4Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized j CVE-2023-472679.8An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VP