CVE-2024-46558

DrayTek Vigor 3910 (version 4.3.2.6) is affected by a buffer overflow in the newProname parameter of the v2x00.cgi endpoint, which can lead to Denial of Service (DoS) via crafted input. The CVE-2024-46558 entry is corroborated across multiple sources in the connected documents, including Red Hat ...

CVE-2024-46586

Draytek Vigor 3910 v4.3.2.6 is affected by CVE-2024-46586 due to a buffer overflow in the sCloudPass parameter of the v2x00.cgi page. Exploitation leads to a Denial of Service (DoS) via a crafted input. Documented impact follows the CVSS vector: Network access, Low attack complexity, No privilege...

CVE-2024-46591

CVE-2024-46591 affects DrayTek Vigor 3910 running version 4.3.2.6. The issue is a buffer overflow in the sDnsPro parameter handled by v2x00.cgi, enabling a crafted input to cause a Denial of Service. The available documents do not provide exploitation details, affected attack methods, or the curr...

CVE-2024-46589

CVE-2024-46589 affects Draytek Vigor 3910 (v4.3.2.6). The issue is a buffer overflow in the sIpv6AiccuUser parameter on the inetipv6.cgi page, leading to a Denial of Service under crafted input. Documented in multiple sources (NVD/Red Hat/NVD mirror entries) with a CVSS v3.1 impact of 7.5 (Availa...

CVE-2024-46580

CVE-2024-46580 affects DrayTek Vigor 3910, version 4.3.2.6. A buffer overflow in the fid parameter of the v2x00.cgi page can cause a Denial of Service (DoS) with a crafted input. The connected documents provide the same vulnerability description; no explicit exploit details, affected other versio...

CVE-2024-46571

CVE-2024-46571 affects DrayTek Vigor 3910 (fwuser.cgi) where a buffer overflow in the sPPPSrvNm parameter can be triggered by crafted input, leading to a Denial of Service (DoS) and availability impact. The vulnerability is documented with a CVSS v3.1 base score of 7.5 (HIGH) with network attack ...

CVE-2024-46551

CVE-2024-46551 affects DrayTek Vigor 3910 (v4.3.2.6). The vulnerability is a buffer overflow in the sBPA_Pwd parameter in the inet15.cgi page, which can be triggered by crafted input and leads to a Denial of Service. Multiple sources confirm the root cause and affected component, but none provide...

CVE-2024-44845

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...

CVE-2024-44844

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the runcommand function...

CVE-2024-44844

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the runcommand function...

CVE-2024-44845

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...

CVE-2024-44845

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...

CVE-2024-44844

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the runcommand function...

DrayTek Vigor3900 安全漏洞

DrayTek Vigor3900 is a high-performance router for enterprise networks from China-based DrayTek. A security vulnerability exists in the DrayTek Vigor3900 v1.5.1.6, which is caused by an authenticated command injection vulnerability via the name parameter in the runcommand function...

CVE-2024-44845

DrayTek Vigor3900 firmware v1.5.1.6 contains an authenticated command injection via the value parameter in the filter_string function. An attacker with valid credentials can inject commands, impacting confidentiality, integrity, and availability (CVSS v3.1 base: High). The connected documents pro...

DrayTek Vigor3900 安全漏洞

DrayTek Vigor3900 is a high-performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor3900 v1.5.1.6, which originates from an authenticated command injection vulnerability via the value parameter in the filterstring function...

CVE-2024-44844

CVE-2024-44844 affects DrayTek Vigor3900 v1.5.1.6. An authenticated command injection vulnerability exists in the run_command function through the name parameter, enabling arbitrary commands with low privileges required and no user interaction. Impact is high on confidentiality, integrity, and av...

CVE-2024-44844

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the runcommand function...

CVE-2024-44845

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...

VulnCheck KEV: CVE-2021-20124

Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...