DrayTek Vigor 2960 RCE: Unauthenticated OS Command Injection

The National Vulnerability Database (NVD) reports CVE-2022-50994, an OS command injection vulnerability in DrayTek Vigor 2960 firmware versions prior to 1.5.1.4. This high-severity flaw (CVSS 8.1) allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter of the CGI login handler. Attackers exploit unsanitized input passed to the otp_check.sh script, leading to remote code execution with web server privileges.

Crucially, exploitation requires knowledge of a valid username and that the target account has Multi-Factor Authentication (MOTP) enabled. While this adds a hurdle, it doesn’t diminish the severity. An attacker who has already compromised user credentials, or can guess common ones, can chain this with the MOTP requirement to gain full remote command execution. This is a critical vector for network perimeter devices.

This vulnerability underscores the importance of rigorous input validation, especially in authentication mechanisms and scripts executed with elevated privileges. For defenders, this is a clear indication that perimeter devices are constant targets and require immediate patching and vigilant monitoring for suspicious activity, even when seemingly minor authentication details are involved.