Vulnerability · Published Mar 29, 2022 · Assigned by mitre
CVE-2021-43118
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 34.8% (higher than 98% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)34.8%top 1.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.
Affected products (as reported)
References
- https://gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26 x_refsource_MISC