CVE-2017-11650

CVE-2017-11650 affects DrayTek Vigor AP910C devices running firmware 1.2.0_RC3 build r6594. The described vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp. Exploitation details beyond the vulnerab...

CVE-2017-11649: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp...

CVE-2017-11650: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0RC3 build r6594 allows remote attackers to inject arbitrary web script or HTML via vectors involving home.asp...

PT-2018-5333

Name of the Vulnerable Software and Affected Versions DrayTek Vigor AP910C version 1.2.0 RC3 build r6594 Description A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that enable SNMP on the device. This is achieved via vectors involving the...

PT-2018-5334

Name of the Vulnerable Software and Affected Versions DrayTek Vigor AP910C version 1.2.0 RC3 build r6594 Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via vectors involving the home.asp page. This could...

Multiple Vulnerabilities in Draytek Vigor 2130

VIGOR 2130 firmware 1.5.4.9 1.1. Command injection in traceroute functionality A user can execute arbitrary commands RCE on the router by abusing the traceroute functionality. The interface expects an IP address as input, but does not validate the input. Just provide the input: ; id The above...

Draytek Vigor ACS-SI multiple security vulnerabilities

Default account, unauthorized access, directory traversal...

VIGOR 2130 Command Injection / Cross Site Request Forgery

VIGOR 2130 firmware 1.5.4.9 1.1. Command injection in traceroute functionality A user can execute arbitrary commands RCE on the router by abusing the traceroute functionality. The interface expects an IP address as input, but does not validate the input. Just provide the input: ; id The above...

Draytek Vigor 3900 1.06 - Privilege Escalation

No description provided by source...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

Code injection

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

CVE-2013-5703

CVE-2013-5703 affects the DrayTek Vigor 2700 router (notably v2.8.3) where a crafted SSID value is mishandled when inserted into the sWlessSurvey list in variables.js. This enables remote attackers to execute arbitrary JavaScript in the router’s web administration context and to modify settings o...

PT-2013-5738

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2700 router version 2.8.3 Description The issue allows remote attackers to execute arbitrary JavaScript code and modify settings or the DNS cache. This is achieved by using a crafted SSID value that is not properly handled during...

CVE-2013-5703: Improper Neutralization of Special Elements used in an OS Command

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

DrayTek Vigor 2700 ADSL router contains a command injection vulnerability

Overview DrayTek Vigor 2700 ADSL router version 2.8.3 and possibly earlier versions contain a command injection vulnerability via malicious SSID CWE-77. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' DrayTek Vigor 2700 ADSL router version 2.8...

Draytek Vigor 3900 1.06 - Privilege Escalation

Exploit for hardware platform in category local exploits Affected device Description: Vigor 3900 Router Firewall : High Performance Multi-WAN VPN Appliance The Vigor 3900 is a high-performance quad-Gigabit WAN router for high-performance applications including remote access, firewalling,...

Draytek Vigor 3900 1.06 - Local Privilege Escalation

Draytek Vigor 3900 1.06 - Local Privilege Escalation Exploit Title: Previlege escalation Date: 19/3/2013 Exploit Author: Mohammad abou hayt Vendor Homepage: http://www.draytek.com.tw/index.php?option=comk2&view=item&layout=item&id=2627&Itemid=593&lang=en Software Link: N/A Version: Vigor 3900...

Draytek Vigor 3900 1.06 - Local Privilege Escalation

Exploit Title: Previlege escalation Date: 19/3/2013 Exploit Author: Mohammad abou hayt Vendor Homepage: http://www.draytek.com.tw/index.php?option=comk2&view=item&layout=item&id=2627&Itemid=593&lang=en Software Link: N/A Version: Vigor 3900 -Hardware V2 - firmware latest 1.06 Privilege escalation...