Vulnerability Details CVE-2023-47254
An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.016
EPSS Ranking 80.9%
CVSS Severity
CVSS v3 Score 9.8
References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt
- https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023-023
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt
- https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023-023
Products affected by CVE-2023-47254
-
cpe:2.3:h:draytek:vigor167:-
-
cpe:2.3:o:draytek:vigor167_firmware:5.2.2