Global infos:

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`

CVE Status: Awaiting Analysis

References:

[email protected]

[email protected]

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	ADJACENT_NETWORK
Availability Impact	HIGH
Base Score	8
Base Severity	HIGH
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Privileges Required	LOW
Scope	UNCHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability Score	2.1
Impact Score	5.9
Source	134c704f-9b21-4f2e-91b3-4a467353bcc0
Type	Secondary

Links:

Exploit-db
Github