Vigor2960 - RCE (CVE-2024-12987)

CVE-2024-12987 is a vulnerability in DrayTek router management interfaces that allows for remote OS command injection via crafted inputs to a web management endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 11th of June 2025.

CrowdSec network observations suggest that most exploitation of CVE-2024-12987 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec network telemetry also shows that exploitation of CVE-2024-12987 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Exploitation typically involves requests to the /cgi-bin/mainfunction.cgi/apmcfgupload URL, with the attack focusing on manipulation of session parameters.