Hermes CTI

← Back to all reports

vulnerability new

CVE-2024-12987

Hunt Playbook Remediation Detections
● HIGH Confidence: 100% · Version 1

Executive summary

Public evidence documents CVE-2024-12987. This report does not assess any organization.

Technical analysis

DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

Evidence and sources

Public evidence for CVE-2024-12987 with preserved provenance.

Authoritative Source Advisories
📄 CISA Known Exploited Vulnerabilities ↗
Verified Evidence Claims

CVE-2024-12987 DrayTek Vigor Routers OS Command Injection Vulnerability DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

Attribution: CISA Known Exploited Vulnerabilities
100% Confidence Analysis 🔍

IOCs

No public IOC is available.

CVEs and affected products

CVE-2024-12987

DrayTek Vigor Routers OS Command Injection Vulnerability

ATT&CK mapping

No ATT&CK mapping is available.

Detection content

Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.

Open dedicated detections page →

Threat hunting

Hypothesis-driven hunt procedures and telemetry checklist.

Open dedicated hunt page →

Remediation

Containment actions, patching notes, and credential steps.

Open dedicated remediation page →

Historical relationships

No published historical relationship is available.

Timeline and change history

Public source record: Public source record for CVE-2024-12987.

Confidence and caveats

1.0

⚠️ Public CTI only; no organizational exposure is asserted.

⚠️ CVSS and EPSS metadata were not present in the retrieved evidence payload.