nmap_draytek_rce

nmapdraytekrce Script nmap para detectar CVE-2020-8515 em dispositivos Draytek...

draytek-arsenal

Draytek Arsenal: Observability and hardening toolkit for Draytek edge devices. Advanced attackers are increasingly choosing edge devices as targets. However, these devices are controlled by closed-source software known as firmware, often distributed in a proprietary format. This is an added...

CVE-2020-8515

CVE-2020-8515 Draytek CVE-2020-8515 PoC, den ich noch herumliegen hatte. Lustigerweise wird der injizierte Befehl zweimal ausgeführt, siehe hier: root@kitploit: $ ./draytek.py draytek.local Führe Befehl aus: cat /etc/passwd + anfällig! Führe Befehl aus: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar...

CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC DrayTek में बिना प्रमाणीकरण के रिमोट कोड निष्पादन भेद्यता CVE-2022-32548 /cgi-bin/wlogin.cgi में username फ़ील्ड के माध्यम से तकनीकी विवरण कमजोर DrayTek उपकरणों का वेब प्रबंधन इंटरफ़ेस /cgi-bin/wlogin.cgi पर लॉगिन पेज पर बफर ओवरफ्लो से प्रभावित है। एक हमलावर लॉगिन पेज के aa...

CVE-2024-12986

CVE-2024-12986 स्कैनर और एक्सप्लॉइट इस रिपॉजिटरी में CVE-2024-12986 भेद्यता के लिए एक स्कैनर और एक्सप्लॉइट शामिल है, जो DrayTek गेटवे डिवाइस के apmcfgupptim एंडपॉइंट में एक कमांड इंजेक्शन भेद्यता है। यह भेद्यता एक हमलावर को प्रभावित डिवाइस पर मनमाने कमांड निष्पादित करने की अनुमति देती है, जिससे...

DrayTek Vigor - Command Injection

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. id: CVE-2020-15415 info: name:...

Draytek VigorConnect 6.0-B3 - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id: CVE-2021-201...

Draytek VigorConnect 1.6.0-B - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id:...

DrayTek Vigor - Command Injection

DrayTek Gateway devices Vigor2960, Vigor300B, etc. are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output. id: CVE-2024-12987 info: name: DrayTek Vigor - Command...

CVE-2026-71943

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

CVE-2026-71939

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causin...

CVE-2026-71942

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mailmailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this...

CVE-2026-71940

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causi...

CVE-2026-71938

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switchlangvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service...

CVE-2026-71941

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diaglogmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this...

CVE-2026-71936

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service...

CVE-2026-71935

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can...

CVE-2026-71934

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via...

CVE-2026-71937

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poescheduleprofile function. The vulnerability is caused by repeated concatenation of the startdate, starttime, durationtime, howoften, weekdays, monthlydate, and cycleduration fields into small fixed-size buffers...

CVE-2026-71933

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...