Embed Notice

I don't know if this is CVE-2024-41585, but this is how I've been getting code exec on my DrayTek Vigor 167 for custom firmware [1] research:

https://gist.github.com/q3k/46f75dd78b653369640efaa2295f7ecd

I wouldn't say post-auth code execution on a device you own is a security vulnerability (good network hardware vendors just ship this as a feature), so I never bothered publishing this before.

This is so trivial I'm sure dozens of other people have been using this, too.

[1] - https://github.com/q3k/vraytekdigor .