CVE-2020-10825

A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request issue 3 of 3...

CVE-2020-10825

CVE-2020-10825 affects DrayTek Vigor3900, Vigor2960, and Vigor300B prior to firmware version 1.5.1. The issue is a stack-based buffer overflow in the /cgi-bin/activate.cgi endpoint during base64 decoding of the ticket parameter, which can enable remote code execution via a remote HTTP request. Th...

CVE-2020-10824

A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request issue 2 of 3...

CVE-2020-10823

A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request issue 1 of 3...

CVE-2020-10823

CVE-2020-10823 affects DrayTek Vigor3900, Vigor2960, and Vigor300B devices running versions prior to 1.5.1. A stack-based buffer overflow exists in the /cgi-bin/activate.cgi endpoint through the var parameter, allowing remote attackers to achieve code execution via a remote HTTP request (issue 1 ...

CVE-2020-8515

CVE-2020-8515 affects DrayTek Vigor2960, Vigor3900 and Vigor300B devices (various Beta firmware versions) via the cgi-bin/mainfunction.cgi endpoint. The root cause is unsafely processed shell metacharacters in POST requests, enabling remote code execution with root privileges without authenticati...

PT-2020-6382

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 versions 1.4.4 Beta and earlier DrayTek Vigor2960 versions 1.3.1 Beta and earlier DrayTek Vigor300B versions 1.3.3 Beta, 1.4.2.1 Beta, and 1.4.4 Beta Description The issue is related to the WebUI interface of DrayTek Vigor...

Vigor Router Configuration Website Has Weak Password Vulnerability

The default password can be passed to access the route and deployed to enable vpn for intranet roaming...

PT-2018-4012

Name of the Vulnerable Software and Affected Versions DrayTek routers versions prior to 2018-05-23 Description The issue is related to a CSRF attack that can change DNS or DHCP settings. It is associated with a flaw in the web interface of DrayTek Vigor router firmware, allowing a remote attacker...

Vigor ACS Unsafe Flex AMF Java Object Deserialization(CVE-2017-5641)

Vulnerability Summary A vulnerability in Vigor ACS allows unauthenticated users to cause the product to execute arbitrary code. VigorACS 2 “is a powerful centralized management software for Vigor Routers and VigorAPs, it is an integrated solution for configuring, monitoring, and maintenance of...

CVE-2017-11649

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

Cross site scripting

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11649

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11650

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

DrayTek Vigor AP910C Cross-Site Request Forgery Vulnerability

DrayTek Vigor AP910C devices is a wireless router product with firewall function from DrayTek. A cross-site request forgery vulnerability exists in DrayTek Vigor AP910C devices using firmware version 1.2.0RC3 build r6594. A remote attacker could exploit the vulnerability to open SNMP on a remote...

DrayTek Vigor AP910C Cross-Site Scripting Vulnerability

DrayTek Vigor AP910C devices is a wireless router product with firewall function from DrayTek. A cross-site request forgery vulnerability exists in DrayTek Vigor AP910C devices using firmware version 1.2.0RC3 build r6594. A remote attacker can exploit this vulnerability to inject arbitrary web...

CVE-2017-11649

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11650

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

CVE-2017-11649

Affected product: DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594. Vulnerability: Cross-site request forgery (CSRF) that lets an attacker hijack the authentication of an unspecified user to enable SNMP via requests to goform/setSnmp. Impact (as stated): enables SNMP on the remote...