CVE-2023-47254

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.20% chance of exploitation in the next 30 days, 82nd percentile

Published

2023-12-09

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt

Security advisories

• https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023…

References

• CVE Record
• NVD entry