Log in Start free

Vulnerability · Published May 8, 2026 · Assigned by VulnCheck

CVE-2022-50994DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

High 8.1

In plain English

A high-severity OS command injection in Vigor 2960 from DrayTek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.4%top 26.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

Affected products (as reported)

VendorProductVersions
DrayTek Vigor 2960 0 – before 1.5.1.4

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References