CVE-2022-50994 - CVE House
Back to Database
Status published Critical CVE-2022-50994

DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

Vulnerability Description

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-50994

Credits & Attribution

No credits recorded in the NVD database.

References

More from DrayTek

View All →
CVE-2024-12987
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
Medium 6.9
CVE-2024-12986
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection
Medium 6.9
CVE-2023-6265
DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
Medium 6.5
CVE-2023-1163
DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal
Medium 6.5
CVE-2023-1162
DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection
High 7.2

Affected Vendor

Affected Software

Vigor 2960
Vulnerable Versions:
0

Timeline

Official Publish: May 8th, 2026
Last Modified: July 15th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration