DrayTek Vigor2960 路径遍历漏洞

DrayTek Vigor2960 is a dual WAN broadband router/VPN gateway from DrayTek, China. A path traversal vulnerability exists in the DrayTek Vigor2960 version 1.5.1.4, which stems from a problem with the function sub1DA58 in the file mainfunction.cgi, which can lead to path traversal...

PT-2023-9805 · Draytek · Draytek Vigor2960

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 2960 versions 1.5.1.4 through 1.5.1.5 Description: A critical vulnerability has been found in the Web Management Interface of DrayTek Vigor 2960, specifically in the function getSyslogFile of the file mainfunction.cgi. The issue...

CVE-2023-23313

Certain Draytek products are vulnerable to Cross Site Scripting XSS via the wlogin.cgi script and userlogin.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915,...

CVE-2023-23313

Certain Draytek products are vulnerable to Cross Site Scripting XSS via the wlogin.cgi script and userlogin.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915,...

PT-2023-9806 · Draytek · Draytek Vigor

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor versions 1.5.1.4 through 1.5.1.5 Description: The issue is related to the function sub 1225C in the mainfunction.cgi script of the DrayTek Vigor web interface, where inadequate data cleaning on the management level can be...

CVE-2023-23313

CVE-2023-23313 affects DrayTek Vigor routers via XSS in the wlogin.cgi and user_login.cgi web portal scripts. Affected models span multiple series and firmware versions (e.g., Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865/2866 v4.4.1.0; Vigor2927 v4.4.2.2; Vigor2915, Vigor2765/2766/2135 v4...

CVE-2023-1009

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

CVE-2023-1009

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

Path traversal

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

CVE-2023-1009

DrayTek Vigor 2960 Web Management Interface contains a path traversal vulnerability in the function sub_1DF14 of /cgi-bin/mainfunction.cgi. Exploitation arises by manipulating the option argument with the input /../etc/passwd-, enabling remote access to sensitive files. Affected versions are 1.5....

CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input...

DrayTek Vigor2960 路径遍历漏洞

DrayTek Vigor2960 is a dual WAN broadband router/VPN gateway from China's DrayTek. A path traversal vulnerability exists in the DrayTek Vigor2960 version 1.5.1.4, which stems from an incorrect operation of the parameter /... /etc/password incorrectly results in path traversal...

PT-2023-9804 · Draytek · Draytek Vigor2960

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 2960 versions 1.5.1.4 through 1.5.1.5 Description: A critical vulnerability has been found in the Web Management Interface of DrayTek Vigor 2960. The issue is related to the function sub 1DF14 of the file...

New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices

A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different...

New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices

A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different...

VulnCheck KEV: CVE-2020-15415

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used...

Securing IoT devices against attacks that target critical infrastructure

South Staffordshire PLC, a company that supplies water to over one million customers in the United Kingdom, notified its customers in August of being a target of a criminal cyberattack. This incident highlights the sophisticated threats that critical industries face today. According to South...

CVE-2022-32548

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field...

CVE-2022-32548

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field...