{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3040", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-23T16:34:06.326Z", "datePublished": "2026-02-23T22:02:07.526Z", "dateUpdated": "2026-02-25T15:37:21.493Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T22:02:07.526Z"}, "title": "DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "DrayTek", "product": "Vigor 300B", "versions": [{"version": "1.5.1.0", "status": "affected"}, {"version": "1.5.1.1", "status": "affected"}, {"version": "1.5.1.2", "status": "affected"}, {"version": "1.5.1.3", "status": "affected"}, {"version": "1.5.1.4", "status": "affected"}, {"version": "1.5.1.5", "status": "affected"}, {"version": "1.5.1.6", "status": "affected"}], "modules": ["Web Management Interface"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that \"300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it.\" This vulnerability only affects products that are no longer supported by the maintainer."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-23T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-23T17:39:13.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "jiefengliang (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347394", "name": "VDB-347394 | DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347394", "name": "VDB-347394 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.757126", "name": "Submit #757126 | DrayTek Vigor 300B v1.5.1.6 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/master-abc/cve/issues/42", "tags": ["exploit", "issue-tracking"]}], "tags": ["unsupported-when-assigned"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:36:47.699598Z", "id": "CVE-2026-3040", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:37:21.493Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3040", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T15:36:47.699598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:37:14.011Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "jiefengliang (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "DrayTek", "modules": ["Web Management Interface"], "product": "Vigor 300B", "versions": [{"status": "affected", "version": "1.5.1.0"}, {"status": "affected", "version": "1.5.1.1"}, {"status": "affected", "version": "1.5.1.2"}, {"status": "affected", "version": "1.5.1.3"}, {"status": "affected", "version": "1.5.1.4"}, {"status": "affected", "version": "1.5.1.5"}, {"status": "affected", "version": "1.5.1.6"}]}], "timeline": [{"lang": "en", "time": "2026-02-23T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-23T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-23T17:39:13.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347394", "name": "VDB-347394 | DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347394", "name": "VDB-347394 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.757126", "name": "Submit #757126 | DrayTek Vigor 300B v1.5.1.6 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/master-abc/cve/issues/42", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that \"300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it.\" This vulnerability only affects products that are no longer supported by the maintainer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T22:02:07.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3040", "state": "PUBLISHED", "dateUpdated": "2026-02-25T15:37:21.493Z", "dateReserved": "2026-02-23T16:34:06.326Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-23T22:02:07.526Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "33679D98-2490-467D-BBB7-C945F2B7BC28", "versionEndIncluding": "1.5.1.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*", "matchCriteriaId": "DA5B988D-ED1A-4CBF-8B34-C5B03A55ED52", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that \"300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it.\" This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en DrayTek Vigor 300B hasta la versi\u00f3n 1.5.1.6. Esta afecta a la funci\u00f3n cgiGetFile del archivo /cgi-bin/mainfunction.cgi/uploadlangs del componente Interfaz de Gesti\u00f3n Web. Manipular el argumento File conduce a una inyecci\u00f3n de comandos del sistema operativo. El ataque puede ser iniciado de forma remota. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proveedor confirma que 'el 300B est\u00e1 al final de su vida \u00fatil (EoL), y esta es una vulnerabilidad autenticada. No planeamos solucionarlo.' Esta vulnerabilidad solo afecta a productos que ya no reciben soporte por parte del mantenedor."}], "id": "CVE-2026-3040", "lastModified": "2026-04-29T01:00:01.613", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2026-02-23T22:16:25.960", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/master-abc/cve/issues/42"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347394"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347394"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.757126"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5.1.6"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Vigor 300B", "source": "cna", "vendor": "DrayTek"}, "product": "vigor300b", "vendor": "draytek"}], "analysis": {"en": {"generated_at": "2026-04-17T16:12:14.212008+00:00", "value": {"mitigation_remediation": ["Determine whether the router model and firmware version are still in use and isolate it from untrusted networks.", "Upgrade to a supported router model or firmware that receives security updates from the vendor or a third\u2011party provider.", "If a replacement is not feasible, restrict access to the Web Management Interface by limiting it to a dedicated management VLAN and applying firewall rules to block inbound traffic from external sources.", "Disable the uploadlangs CGI component if the firmware allows disabling specific CGI scripts.", "Monitor device logs for anomalous upload attempts or command execution patterns."], "summary": {"action": "Assess Impact", "impact": "Operating system command injection via the uploadlangs CGI in DrayTek Vigor 300B's web interface can allow an attacker to execute arbitrary commands on the device, potentially leading to full system compromise."}, "threat_synthesis": {"affected_systems": "DrayTek Vigor 300B routers running firmware up to version 1.5.1.6 are affected. The device is End\u2011of\u2011Life and no longer receives vendor support or security patches. The vulnerability requires authenticated access to the web management interface, though attackers can target devices from outside the local network if the interface is exposed.", "description_and_impact": "The vulnerability resides in the cgiGetFile argument handling of the uploadlangs CGI, enabling an attacker to inject shell commands through the File parameter. This leads to operating\u2011system command execution, a form of remote code execution that can compromise confidentiality, integrity, and availability of the affected device. The weakness is catalogued as both CWE\u201177 (Command Injection) and CWE\u201178 (OS Command Injection).", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation typically requires the attacker to have administrative credentials to access the web interface, but once authenticated, the command injection can be triggered remotely through the uploadlangs endpoint. Because the vendor will not issue a fix, any device with the exposed web interface remains at risk."}}}}, "created": "2026-02-24T09:54:40.452614+00:00", "updated": "2026-04-17T16:15:22.651133+00:00", "vendors": ["draytek", "draytek$PRODUCT$vigor300b"]}