Draytek VigorConnect cross-site scripting vulnerability

A stored cross-site scripting vulnerability exists in the Profile Name field of the Floor Plan Network Menu page in Draytek VigorConnect version 1.6.0-B3, the native network management software for DrayTek devices. The vulnerability stems from improper validation of user input. An attacker could...

PT-2021-8210

Name of the Vulnerable Software and Affected Versions Draytek VigorConnect version 1.6.0-B3 Description The issue is related to a stored XSS vulnerability in the Profile Name field of the floor plan page in the Network Menu. This vulnerability arises because user input is not properly sanitized,...

PT-2021-8208

Name of the Vulnerable Software and Affected Versions DrayTek VigorConnect version 1.6.0-B3 Description The issue is related to a lack of cross-site request forgery protections and insufficient verification of well-formed, valid, and consistent requests. This could allow a remote attacker to...

PT-2021-8209

Name of the Vulnerable Software and Affected Versions Draytek VigorConnect version 1.6.0-B3 Description A vulnerability exists in the file upload functionality of DownloadFileServlet, allowing an unauthenticated attacker to upload files to any location on the target operating system with root...

PT-2021-8207

Name of the Vulnerable Software and Affected Versions Draytek VigorConnect version 1.6.0-B3 Description The issue is related to a lack of access control in the software for monitoring, managing, and configuring VigorAP access points and VigorSwitches switches in the local network. An arbitrary fi...

PT-2021-8120 · Draytek · Draytek Vigorconnect

Name of the Vulnerable Software and Affected Versions: Draytek VigorConnect version 1.6.0-B3 Description: A local file inclusion vulnerability exists in the file download functionality of the "DownloadFileServlet" endpoint. An unauthenticated attacker could leverage this vulnerability to download...