CVE-2024-12987

What it actually does

CVE-2024-12987 is a critical OS command injection vulnerability in the DrayTek Vigor2960 and Vigor300B Web Management Interface, affecting firmware version 1.5.1.4. The vulnerable endpoint is /cgi-bin/mainfunction.cgi/apmcfgupload, where unsafe handling of the session argument allows an unauthenticated remote attacker to inject operating system commands that execute on the router with the privileges of the web management process. Because this is a network-edge device vulnerability with public exploit availability, active exploitation, KEV listing, and a very high EPSS score, exposed management interfaces should be treated as high-risk until verified patched or isolated.

Why it matters to the business

Successful exploitation can give an attacker control over affected routers, enabling traffic interception, configuration theft, credential harvesting, persistence on the network edge, botnet enrollment, proxying of malicious traffic, and pivoting into internal systems. Since these devices often sit at branch, VPN, or perimeter locations, compromise can disrupt connectivity and undermine trust in network routing and remote access. The vulnerability is listed in CISA KEV with a remediation due date of 2025-06-05 and has active in-the-wild exploitation, so delayed remediation materially increases operational and regulatory risk.

How an attack unfolds

An attacker first identifies DrayTek Vigor2960 or Vigor300B devices with the web management interface reachable over the internet or another accessible network. They then send a crafted request to /cgi-bin/mainfunction.cgi/apmcfgupload containing malicious shell metacharacters or command syntax in the session parameter. The vulnerable CGI handler passes the attacker-controlled value into an operating system command without adequate validation or escaping, causing the injected command to run on the device. After initial command execution, the attacker may retrieve device configuration, add or modify administrator access, download additional tooling, alter DNS or routing settings, establish a reverse shell or proxy, and use the router as a foothold for surveillance, credential theft, botnet activity, or lateral movement.

How to fix it

Upgrade affected DrayTek Vigor2960 and Vigor300B devices from firmware version 1.5.1.4 to version 1.5.1.5 or later. If immediate upgrade is not possible, disable internet exposure of the web management interface, restrict management access to trusted administrative networks or VPN-only paths, enforce strong administrative credentials and MFA where supported, and apply firewall rules that block access to /cgi-bin/mainfunction.cgi/apmcfgupload from untrusted sources. After patching, review device configuration for unauthorized changes, rotate local administrator credentials and any secrets stored on or routed through the device, and consider factory reset/rebuild from a trusted firmware image if compromise is suspected.

How to confirm the fix worked

Confirm each DrayTek Vigor2960 and Vigor300B device is running firmware 1.5.1.5 or later. Verify that firmware version 1.5.1.4 is no longer present in asset inventory, vulnerability scan results, or device management consoles. Test externally and internally that the web management interface is not reachable from untrusted networks unless explicitly required and protected. Review access controls to confirm only approved administrative source IP ranges can reach the management service. Where safe and authorized, validate that requests to /cgi-bin/mainfunction.cgi/apmcfgupload with shell metacharacters in the session parameter do not result in command execution and are rejected, sanitized, or logged as invalid.

Typical attack path

1. Scan for internet-exposed DrayTek Vigor2960 or Vigor300B web management interfaces.
2. Fingerprint firmware or behavior consistent with vulnerable firmware version 1.5.1.4.
3. Send a crafted request to /cgi-bin/mainfunction.cgi/apmcfgupload with command syntax embedded in the session parameter.
4. Confirm command execution through response behavior, outbound callbacks, or device-side changes.
5. Run reconnaissance commands on the device to identify network configuration, users, firmware, and connectivity.
6. Deploy persistence, modify router configuration, or download additional payloads using built-in utilities.
7. Use the compromised router to intercept traffic, proxy attacks, join botnet infrastructure, or pivot toward internal services.

How to detect it

Check whether exploitation already occurred by reviewing web management access logs, firewall logs, reverse proxy logs if present, NetFlow, DNS logs, and any centralized syslog from DrayTek devices. Focus on requests to /cgi-bin/mainfunction.cgi/apmcfgupload, especially POST requests or requests containing a session parameter with shell metacharacters such as semicolons, pipes, backticks, command substitution, URL-encoded command separators, or references to download utilities. Look for unexpected outbound connections from routers shortly after management-interface requests, particularly HTTP, HTTPS, DNS, TFTP, or raw TCP callbacks to unfamiliar external IPs. Review device configuration backups and current configuration for newly added admin accounts, changed passwords, unauthorized DNS servers, altered VPN profiles, new port forwards, unexpected static routes, modified remote management exposure, or unfamiliar scheduled/startup behavior. Investigate signs of payload retrieval or command execution such as wget, curl, tftp, busybox, sh, telnetd, nc, or reverse-shell style activity. Because many routers have limited forensic retention, absence of local logs does not prove absence of compromise; correlate perimeter telemetry and configuration drift over time.

• /cgi-bin/mainfunction.cgi/apmcfgupload
• mainfunction.cgi/apmcfgupload
• apmcfgupload
• session=
• GET /cgi-bin/mainfunction.cgi/apmcfgupload
• POST /cgi-bin/mainfunction.cgi/apmcfgupload
• session=%3B
• session=;
• session=%7C
• session=|
• session=%60
• session=`
• session=%24%28
• session=$(
• ;wget
• %3Bwget
• ;curl
• %3Bcurl
• ;tftp
• %3Btftp
• busybox wget
• /bin/sh
• sh -c
• telnetd
• nc -e

What your security team should do

• Immediately identify all DrayTek Vigor2960 and Vigor300B devices and determine firmware versions.
• Prioritize internet-exposed or third-party-accessible devices for emergency upgrade to firmware 1.5.1.5 or later.
• Treat unpatched devices as potentially compromised because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and has a very high EPSS likelihood.
• Disable or restrict remote web management access to trusted administrative networks only.
• Search historical web, firewall, VPN, proxy, and device logs for requests to /cgi-bin/mainfunction.cgi/apmcfgupload, especially with suspicious session parameter values.
• Inspect router configurations for unauthorized users, altered DNS settings, unexpected port forwards, VPN changes, routing changes, startup scripts, scheduled tasks, or unknown remote management settings.
• Rotate router administrator credentials and any credentials that may have traversed or been stored on compromised devices.
• If exploitation indicators are found, isolate the device, preserve logs and configuration, reflash or factory reset with trusted firmware, restore known-good configuration, and monitor for follow-on activity from the device’s public and internal IP addresses.