CVE-2024-12987 is an OS command injection vulnerability in DrayTek Vigor Routers. CISA added it to the Known Exploited Vulnerabilities catalogue on 15 May 2025, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means for DrayTek Vigor routers
OS command injection means an attacker can cause the router to execute system commands instead of only handling normal network traffic. On an internet-facing appliance, that can quickly turn a web-facing flaw into device compromise, configuration tampering, or a foothold into the wider network.
For a router class product, the danger is not just that the management interface is exposed. The real issue is that command execution can let an attacker move from a request to operating-system level actions, which can affect routing, DNS, credentials, logging, and remote access paths. That is why exploited router bugs are treated as high priority even before every detail of exploitation is known.
Why exploited router command injection is dangerous
Routers sit at a trust boundary. If an attacker can execute commands on the device, they may be able to change forwarding, redirect traffic, create covert access, or weaken monitoring. In practice, the appliance can become both the initial entry point and the persistence layer.
This class of vulnerability is especially concerning when the device supports administration from the internet, remote support functions, or reusable credentials. A compromise can expose more than the router itself, because attackers often use network infrastructure to reach internal systems, intercept authentication flows, or stage follow-on access.
For vulnerability context, organisations should treat the vendor advisory and the NIST National Vulnerability Database as the main sources for affected-version and remediation details, and the CVE Program for the canonical identifier record.
How organisations assess exposure and reduce blast radius
The first question is whether the routers exist anywhere in the estate, especially at branch sites, small offices, and other locations where asset visibility is weaker. Exposure increases sharply if the management plane is reachable from the public internet or if the device is depended on for remote access.
Compensating controls matter when immediate patching is not possible. Limit management access to trusted administrative networks, remove unnecessary internet exposure, restrict who can reach the device, and review whether any stored secrets or remote management integrations depend on that router. For patch prioritisation and verification discipline, the Vulnerability Management Guide is a useful companion for deciding what to fix first and how to confirm closure.
Detection, recovery, and compromise review
Because command injection can lead to active device manipulation, organisations should assume the router may have been used for more than a one-time configuration change. Review logs, configuration history, remote access settings, and any unexpected outbound connections or DNS changes tied to the device.
Post-patch review should also check for persistence. Attackers who gain command execution on a router may add accounts, alter firewall rules, change forwarding paths, or preserve access through hidden configuration changes. If the device handled administrative secrets or authenticated sessions, those credentials should be treated as potentially exposed and rotated where relevant.
Risk and Threat Considerations
This vulnerability is risky because router compromise can affect both availability and trust. A successful exploit may let an attacker control traffic flow, intercept internal access, or use the device as a durable foothold inside the network.
Failure mechanism: The injection point lets attacker-controlled input be interpreted as an operating-system command, which can bypass normal application logic and grant actions at the device level.
Impact: The attacker may change router configuration, weaken perimeter controls, harvest credentials or sessions, and pivot into connected internal systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Command injection is prevented by validating and constraining untrusted input. |
| AC-17 — Remote Access | Internet-reachable administration is a major exposure path for exploited routers. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Router compromise review depends on auditing and analysing device activity and changes. | |
| Recommendation — Validate router management inputs to block command metacharacters and unsafe request handling. Restrict administrative remote access to trusted networks and approved channels only. Review router audit and configuration records for signs of exploitation or persistence. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Routers require hardened configuration and reduction of unnecessary exposure. |
| CIS-7 — Continuous Vulnerability Management | Exploited router flaws need fast identification, prioritisation, and remediation tracking. | |
| Recommendation — Harden router settings, disable unnecessary services, and remove public management exposure. Track router exposure, prioritise the fix, and verify remediation across the fleet. | ||
Practitioner Guidance
Why practitioners should care: For internet-facing infrastructure, an exploited router is not just a device issue, it is a network trust issue. Prioritise it as a potential perimeter compromise, not a routine maintenance task.
What to watch for: Treat unexplained configuration drift, new management access paths, unusual outbound traffic, and changes to DNS or firewall policy as signs that the device may need a deeper compromise review.
Practitioner takeaway: If the router cannot be patched immediately, reduce exposure first, then verify whether the device has already been used as a foothold before you declare remediation complete.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org