CVE-2024-12987 is an unauthenticated OS command injection in the web management interface of DrayTek Vigor2960, Vigor300B and Vigor3900 load-balancing routers, letting a remote attacker with no credentials run arbitrary commands on the device, and it is being actively exploited at scale against internet-exposed gateways.
Vulnerability summary
9.8
Critical
98.2%
EPSS score (FIRST)
Yes
CISA KEV catalog
2024-12-27
Published
Vulnerability ID: CVE-2024-12987 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| DrayTek Vigor2960 / Vigor300B / Vigor3900 load-balancing routers | cpe:2.3:o:draytek:vigor2960_firmware:1.5.1.4:*:*:*:*:*:*:* | Firmware 1.5.1.4 (confirmed on Vigor2960 and Vigor300B; Vigor3900 also listed by vendor release notes) — fixed in 1.5.1.5 |
What this means
CVE-2024-12987 is an OS command injection (CWE-78) in the Web Management Interface of DrayTek's Vigor2960, Vigor300B and Vigor3900 — load-balancing/VPN gateway routers marketed at SMBs and branch offices. NVD's analysis describes it as: "an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used" (NVD).
NVD's own Primary analysis rates this CVSS v3.1 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability. This differs sharply from the originating VulDB/CNA submission, which rated the same flaw only 7.3 (HIGH) under CVSS v3.1 and 6.9 (MEDIUM) under CVSS v4.0, reasoning that the exposed data/impact was "low" rather than "high" (NVD); NVD's re-scoring to 9.8 reflects that unauthenticated OS command injection on a router's management plane gives an attacker full control of the device, not a partial information leak.
The flaw was originally documented in a public researcher write-up ("netsecfish") showing that a crafted HTTP POST to the apmcfgupload endpoint, with shell metacharacters in the session parameter, executes attacker-supplied commands with no authentication at all, and the researcher's own scanning found roughly 66,000 internet-facing DrayTek Vigor devices exposing the vulnerable interface (NVD references). DrayTek published firmware 1.5.1.5 release notes for all three affected models (Vigor2960, Vigor300B and Vigor3900) addressing the issue (DrayTek Vigor2960 1.5.1.5 release notes).
CISA added CVE-2024-12987 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-05-15, with a required-action due date of 2025-06-05, recommending organizations apply vendor mitigations, follow BOD 22-01 guidance for internet-exposed management interfaces, or discontinue use of the product if unpatched (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at an extremely high 0.98163 (99.914th percentile), consistent with widespread botnet scanning and exploitation of exposed DrayTek management interfaces (FIRST EPSS). Any Vigor2960, Vigor300B or Vigor3900 running firmware 1.5.1.4 or earlier should be upgraded to 1.5.1.5 immediately, and the web management interface should never be exposed directly to the internet.
Evidence
- Unauthenticated OS command injection via the session argument of the apmcfgupload endpoint in the Vigor2960/Vigor300B/Vigor3900 web management interface; publicly disclosed exploit. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, overriding the originating CNA's lower 7.3/6.9 scores. — NVD
- DrayTek released firmware 1.5.1.5 for Vigor2960, Vigor300B and Vigor3900 fixing the issue. — DrayTek firmware release notes
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-15, due date 2025-06-05. — CISA KEV
- EPSS score is 0.98163 (99.914th percentile) as of 2026-10-30. — FIRST EPSS
