What is CVE-2024-12987?

CVE-2024-12987 is a high-severity vulnerability in Draytek Vigor2960, classified under OS Command Injection. CVSS score: 7.3/10. Published 2024-12-27.

How severe is CVE-2024-12987?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2024-12987 known to be exploited?

Yes. CVE-2024-12987 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-05-15), indicating it is being actively exploited. 5 public proof-of-concept repositories are indexed.

RCE in Draytek Vigor2960

CVE-2024-12987

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The mani…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.790 (99.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Draytek Vigor2960 — versions 1.5.1.4
Draytek Vigor300b — versions 1.5.1.4

Weakness classification (CWE)

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2025-05-15. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2025-06-05.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public proof-of-concept exploits

References

VDB-289380 | DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection (vdb-entry, technical-description)
VDB-289380 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
Submit #468795 | DrayTek Vigor2960, Vigor300B 1.5.1.4 Command Injection (third-party-advisory)
netsecfish.notion.site/Command-Injection-in-apmcfgupload-endpoint-for-DrayTek-G… (exploit)

Frequently asked questions

What is CVE-2024-12987?: CVE-2024-12987 is a high-severity vulnerability in Draytek Vigor2960, classified under OS Command Injection. CVSS score: 7.3/10. Published 2024-12-27.
How severe is CVE-2024-12987?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2024-12987 known to be exploited?: Yes. CVE-2024-12987 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-05-15), indicating it is being actively exploited. 5 public proof-of-concept repositories are indexed.