Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-12987

MediumExploitedPublic exploit

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4.

Published Dec 27, 2024 · Updated Oct 30, 2025

Key Facts

Patch immediately
  • CVE-2024-12987 is a medium-severity vulnerability (CVSS 6.9 v4) affecting Vigor2960 Firmware (Draytek), Vigor300b Firmware (Draytek), Vigor2960 and 1 more product.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 12, 2025. Public exploit code is available.
  • EPSS estimates a 98% probability of exploitation in the next 30 days.
  • No fixed version is listed yet; check the vendor advisory for mitigations.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v4

6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (30-day exploit likelihood)

98%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2024-12987 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVMay 15, 2025Jun 5, 2025Not reported
Industry KEV feedFeb 12, 2025Jun 5, 2025Not reported
CIRCL KEVFeb 12, 2025Jun 5, 2025Not reported
ENISA EUVDMay 15, 2025n/aNot reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

4 affected entries in total
ProductAffected versionsFixed in
Vigor2960 FirmwareDraytek1.5.1.4n/a
Vigor300b FirmwareDraytek1.5.1.4n/a
Vigor2960>= 1.5.1.4n/a
Vigor300B>= 1.5.1.4n/a

Timeline

  1. Publicly disclosed

    Dec 27, 2024

  2. Added to Industry KEV feed

    Feb 12, 2025

  3. Added to CIRCL KEV

    Feb 12, 2025

  4. Added to CISA KEV

    May 15, 2025

  5. Added to ENISA EUVD

    May 15, 2025

  6. Last updated

    Oct 30, 2025

Weakness Type

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References

13 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-12987 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo