DrayTek Vigor 3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from China-based DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and prior versions, which originates from the Vigor Management UI's httpd server using static strings to seed OpenSSL's...

CVE-2024-41591

CVE-2024-41591 affects DrayTek Vigor3910 devices (firmware up to 4.3.2.6) with an unauthenticated DOM-based reflected XSS in the Web UI. Root cause: insufficient protection for the web page structure in the router’s firmware, enabling manipulation of the DOM by crafted input. Impact: cross-site s...

CVE-2024-41590

Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6...

CVE-2024-41587

Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6...

CVE-2024-41589

CVE-2024-41589 affects DrayTek Vigor310 devices up to firmware version 4.3.2.6, where authentication requests are performed over unencrypted HTTP. The vulnerability is described as enabling adversaries to compromise confidentiality, integrity, and availability, with a CVSS v3.1 base score of 8.8 ...

CVE-2024-41594

DrayTek Vigor310 devices up to version 4.3.2.6 are affected by CVE-2024-41594 due to the httpd server seeding the OpenSSL PRNG with a static string. This enables an information-disclosure vector (and related MITM risk) via the Vigor310 management UI. Connected sources provide concrete details: af...

CVE-2024-41584

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter...

DrayTek Vigor 3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and prior versions, which stems from a lack of validation of the sFormAuthStr parameter...

DrayTek Vigor 3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and prior versions, which stems from the inclusion of an operating system command injection vulnerability...

CVE-2024-41589

DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests...

CVE-2024-41593

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ftpayloaddns, because a byte sign-extension operation occurs for the length argument of a memcpy call, leading to a heap-based Buffer Overflow...

DrayTek Vigor 3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and prior versions, which is caused by a stack-based overflow when processing query string parameters...

CVE-2024-41592

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs...

DrayTek Vigor3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor3910 version 4.3.2.6 and prior versions, which stems from improper retrieval and handling of CGI form parameters...

CVE-2024-41596

Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 in the Vigor management UI because of improper retrieval and handling of the CGI form parameters...

CVE-2024-41587

Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6...

CVE-2024-41595

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds checks on read and write operations...

CVE-2024-41583

CVE-2024-41583 affects DrayTek Vigor3910 devices up to firmware 4.3.2.6, enabling stored XSS by authenticated users due to poor sanitization of the router name. Impact is limited to web UI context with MEDIUM severity (CVSS 3.1: 4.7). Red Hat and NVD corroborate the issue; NCSC notes vendors have...

CVE-2024-41589

DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests...

CVE-2024-41586

A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component...