The reference for CVE-2024-48074

CVE-2024-48074.txt

[CVE ID]
CVE-2024-48074

[PRODUCT]
draytek - vigor2960

[FIRMWARE VERSION]
v1.4.4

[Vulnerability Type]
CWE-78 - os command injection

[Description]
An authorized RCE vulnerability exists in the Vigor2960 router, where an attacker can place a malicious command into the `table` parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function in the command splice string.

[Details]
https://github.com/Giles-one/Vigor2960Crack