DrayTek Vigor 2960 OS Command Injection Vulnerability in CGI Login Handler

A command injection vulnerability has been identified in the DrayTek Vigor 2960 router's firmware versions prior to 1.5.1.4. This vulnerability resides in the CGI login handler, where unauthenticated remote attackers can execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. The exploitation takes advantage of unsanitized input directed to the otp_check.sh script, allowing remote code execution with web server privileges. Successful exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, with the executed commands running under the privileges of the web server.