CVE-2024-12987

A critical vulnerability has been identified in the web management interface of specific DrayTek router models, namely the Vigor2960 and Vigor300B, running firmware version 1.5.1.4. The flaw resides in an unspecified function of the file responsible for handling configuration uploads, specifically the argument manipulation of the session parameter. This weakness allows for operating system command injection, which can be exploited remotely by an attacker. The nature of this vulnerability indicates that an unauthenticated user could potentially execute arbitrary commands on the underlying operating system, leading to severe security implications.

The attack vectors for this vulnerability are particularly concerning due to the remote nature of the exploit. An attacker could leverage this flaw by crafting a malicious request to the web management interface, manipulating the session argument to inject OS commands. This could be done from anywhere on the internet, provided the management interface is accessible. Once the command injection is successful, the attacker gains the ability to execute commands with the privileges of the web server process, which could lead to unauthorized access, data exfiltration, or even complete system compromise. Scenarios could include deploying malware, altering configurations, or pivoting to other devices within the network.

The real-world impact of this vulnerability is significant, especially for organizations relying on these routers for their network infrastructure. Given the critical nature of the flaw, successful exploitation could lead to substantial business risks, including data breaches, loss of sensitive information, and potential downtime. The ability for an attacker to execute commands remotely raises the stakes, as it could facilitate further attacks on internal systems or expose the organization to regulatory penalties if sensitive data is compromised. The financial implications of such breaches can be severe, encompassing both immediate remediation costs and long-term reputational damage.

Detection of this vulnerability can be challenging, as it may not generate obvious indicators of compromise. Organizations should implement robust logging and monitoring of their network traffic, particularly for any unusual requests targeting the web management interface of the affected devices. Intrusion detection systems (IDS) can be configured to alert on suspicious patterns that may indicate an attempted exploitation of this vulnerability. Regular vulnerability scanning should also be conducted to identify any instances of the affected firmware versions within the network.

Mitigation strategies are straightforward but critical. The primary recommendation is to upgrade the affected devices to the latest firmware version, which addresses this vulnerability. Organizations should prioritize this upgrade process, especially if the devices are exposed to the internet. Additionally, implementing network segmentation and restricting access to the management interface to trusted IP addresses can further reduce the risk of exploitation. Regular security assessments and adherence to best practices in device management will also help in maintaining a secure network environment, minimizing the potential impact of such vulnerabilities in the future.

The CVSS score for CVE-2024-12987 has been revised downward from 9.8 to 7.3, reflecting a reassessment of the vulnerability’s impact and exploitability. This adjustment indicates that while the vulnerability remains critical, its potential for widespread, high-severity exploitation is somewhat less than initially estimated. CSURFACE threat intelligence notes that this change aligns with a more nuanced understanding of the attack vector and the conditions required for successful exploitation, which may be more constrained than previously thought. Our telemetry continues to show stable exploit activity without a marked escalation or emergence of new proof-of-concept exploits, suggesting that adversaries have not significantly increased their operational use of this vulnerability. The EPSS score remains high, placing it in the upper percentiles for exploit likelihood, but the stable trend underscores a steady rather than rapidly growing threat. This recalibration of severity should prompt defenders to maintain vigilance but also to contextualize the risk within a broader threat landscape where other vulnerabilities may present more immediate or severe exploitation opportunities.

Update 2 — June 13, 2026

CSURFACE threat intelligence has noted a revision in the CVSS severity rating for CVE-2024-12987, elevating it from 7.3 to 9.8. This adjustment reflects a reassessment of the vulnerability’s impact, particularly emphasizing its remote code execution potential via OS command injection in the DrayTek Vigor2960 and Vigor300B web management interfaces. Although our telemetry does not indicate a marked escalation in exploitation attempts or the emergence of new proof-of-concept exploits, the heightened CVSS score signals a critical risk that demands increased attention. The vulnerability’s inclusion in the KEV catalog further underscores its priority status within the vulnerability management ecosystem. While the EPSS score remains high and stable, indicating a persistent likelihood of exploitation, the absence of a rapid increase in exploit activity suggests adversaries have not yet intensified operational use. This change elevates the threat level to critical, reinforcing the need for defenders to prioritize monitoring and mitigation efforts accordingly, as the potential impact of successful exploitation could be severe.

Update 3 — July 05, 2026

CSURFACE threat intelligence has detected a modest but meaningful uptick in activity exploiting CVE-2024-12987, reflected by a discernible increase in telemetry signals related to attempts targeting the vulnerable DrayTek Vigor2960 and Vigor300B devices. While the overall exploit landscape remains unchanged with no new public exploit variants emerging, this rise in detection frequency signals growing adversary interest or opportunistic scanning campaigns. The vulnerability’s critical severity and inclusion in the KEV catalog continue to underscore its high priority for defensive focus. This recent trend elevates the operational risk, indicating that threat actors may be incrementally intensifying reconnaissance or preparatory actions, which could precede more widespread exploitation attempts. Consequently, the threat level should be considered increasingly urgent, warranting heightened vigilance in monitoring and incident response activities.