CVE-2021-43118

CRITICAL 9.8CVE-2021-43118 · Published 29/03/2022 · updated 17/06/2026

In short

CVE-2021-43118 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 34.8%, higher than 98.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.

References

gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free