Vulnerability CVE-2023-47254
Published: 2023-12-09   Modified: 2023-12-14

Description:
An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.

Type:

CWE-78

 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') )

 References:
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt
https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023-023
Copyright 2026, cxsecurity.com

 

Back to Top