PatchTheCVECVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability
CVE-2024-12987 is a high-severity flaw (CVSS 7.3) affecting vigor300b firmware, vigor2960 firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to
Why this priority
- High severity
- EPSS top 1%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: DrayTek Vigor - Command Injection
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-12987?
vigor300b firmware: mitigate or apply the listed mitigation; vigor2960 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2024-12987 being exploited?
Yes. CVE-2024-12987 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2024-12987 affect?
CVE-2024-12987 affects vigor300b firmware, vigor2960 firmware. Severity is high (CVSS 7.3). A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manip
How urgent is CVE-2024-12987?
Priority 89/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-3040 MEDIUM 4.7 UPGRADE A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6
- CVE-2024-43027 HIGH 8.0 UPGRADE UPGRADE DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before
- CVE-2024-12986 HIGH 7.3 UPGRADE UPGRADE A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1