DrayTek Vigor - Command Injection

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. id: CVE-2020-15415 info: name:...

CVE-2020-8515

CVE-2020-8515 Draytek CVE-2020-8515 PoC 我早就写好的。 有趣的是，注入的命令会被执行两次，看这里： root@kitploit: $ ./draytek.py draytek.local executing command: cat /etc/passwd + vulnerable! executing command: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar 28 00:49:28 CST 2018 armv6l unknown Linux Vigor3900 2.6.33.5 1 Wed Mar ...

draytek-arsenal

Draytek Arsenal: kit de observabilidad y endurecimiento para dispositivos perimetrales Draytek. Los atacantes avanzados eligen cada vez más los dispositivos perimetrales como objetivos. Sin embargo, estos dispositivos están controlados por software de código cerrado conocido como firmware, a menu...

CVE-2024-12986

CVE-2024-12986 扫描器与漏洞利用工具 本仓库包含针对 CVE-2024-12986 漏洞的扫描器与漏洞利用工具。该漏洞是 DrayTek 网关设备 apmcfgupptim 端点中的一个命令注入漏洞 。攻击者可利用该漏洞在受影响设备上执行任意命令，可能导致系统完全沦陷。 漏洞概述 该漏洞存在于 DrayTek 网关设备的 apmcfgupptim 端点中。通过构造恶意 HTTP 请求，攻击者可以向 session 参数注入任意命令，从而在目标设备上实现命令执行。 更多详情，请参阅原始披露： Command Injection in apmcfgupptim endpoint...

CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC Vulnerabilidad de ejecución remota de código no autenticada en DrayTek CVE-2022-32548 en /cgi-bin/wlogin.cgi mediante el campo de nombre de usuario Detalles técnicos La interfaz de administración web de los dispositivos DrayTek vulnerables está afectada por un desbordamient...

nmap_draytek_rce

nmapdraytekrce Draytek デバイス上の CVE-2020-8515 を検出するための nmap スクリプト...

Draytek VigorConnect 1.6.0-B - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id:...

Draytek VigorConnect 6.0-B3 - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id: CVE-2021-201...

DrayTek Vigor - Command Injection

DrayTek Gateway devices Vigor2960, Vigor300B, etc. are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output. id: CVE-2024-12987 info: name: DrayTek Vigor - Command...

DrayTek - Remote Code Execution

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. id: CVE-2020-8515 info: name: DrayTek - Remote Code Execution...

Vulnerabilities in DrayTek VigorSwitch

DrayTek has addressed several vulnerabilities in the VigorSwitch product line. These vulnerabilities primarily involve command injection, buffer overflows, null pointer dereferencing, directory traversal, and insufficient authorization checks in various functions of the DrayTek VigorSwitch device...

CVE-2026-71943

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

CVE-2026-71939

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causin...

CVE-2026-71942

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mailmailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this...

CVE-2026-71940

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causi...

CVE-2026-71941

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diaglogmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this...

CVE-2026-71938

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switchlangvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service...

CVE-2026-71936

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service...

CVE-2026-71935

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can...

CVE-2026-71933

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...