CVE-2024-12986

CVE-2024-12986 Scanner and Exploit This repository contains a scanner and exploit for the CVE-2024-12986 vulnerability, which is a command injection vulnerability in the apmcfgupptim endpoint of DrayTek Gateway Devices. The vulnerability allows an attacker to execute arbitrary commands on the...

nmap_draytek_rce

nmapdraytekrce nmap script to detect CVE-2020-8515 on Draytek Devices...

draytek-arsenal

Draytek Arsenal: Observability and hardening toolkit for Draytek edge devices. Advanced attackers are increasingly choosing edge devices as targets. However, these devices are controlled by closed-source software known as firmware, often distributed in a proprietary format. This is an added...

CVE-2020-8515

CVE-2020-8515 Draytek CVE-2020-8515 PoC I had kicking about. Amusingly, the command injected gets executed twice, see here: $ ./draytek.py draytek.local executing command: cat /etc/passwd + vulnerable! executing command: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar 28 00:49:28 CST 2018 armv6l...

CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC DrayTek unauthenticated remote code execution vulnerability CVE-2022-32548 in /cgi-bin/wlogin.cgi via username field Technical details The web management interface of the vulnerable DrayTek devices is affected by a buffer overflow on the login page at /cgi-bin/wlogin.cgi. A...

DrayTek Vigor uploadlangs command injection root RCE

Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE.""" from future import annotations import uuid from kittysploit import from...

DrayTek Vigor 2960 uploadlangs command injection root RCE

Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE multi platform.""" from future import annotations import uuid from kittysploit import...

DrayTek Vigor - Command Injection

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. id: CVE-2020-15415 info: name:...

Draytek VigorConnect 6.0-B3 - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id: CVE-2021-201...

Draytek VigorConnect 1.6.0-B - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id:...

DrayTek Vigor - Command Injection

DrayTek Gateway devices Vigor2960, Vigor300B, etc. are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output. id: CVE-2024-12987 info: name: DrayTek Vigor - Command...

CVE-2026-113397

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequestcertificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launche...

CVE-2026-113395

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the...

CVE-2026-113396

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function renametable of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated...

CVE-2026-113394

A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-113393

A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument uploadpath/uploadname can lead to unrestricted upload. The attack may...

CVE-2026-113397 DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequestcertificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launche...

EUVD-2026-105016

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequestcertificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launche...

CVE-2026-113397 DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequestcertificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launche...

CVE-2026-113397

The DrayTek Vigor2960 (version 1.5.1.6 Revision 8218) is vulnerable to a remote command injection vulnerability in the IPsec Handler component. The flaw exists within the ruequest_certificate function of the /cgi-bin/mainfunction.cgi file, where manipulation of the argument option allows for unau...