CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC DrayTek unauthenticated remote code execution vulnerability CVE-2022-32548 in /cgi-bin/wlogin.cgi via username field Technical details The web management interface of the vulnerable DrayTek devices is affected by a buffer overflow on the login page at /cgi-bin/wlogin.cgi. A...

CVE-2024-12986

CVE-2024-12986 Scanner and Exploit This repository contains a scanner and exploit for the CVE-2024-12986 vulnerability, which is a command injection vulnerability in the apmcfgupptim endpoint of DrayTek Gateway Devices. The vulnerability allows an attacker to execute arbitrary commands on the...

CVE-2026-129453

A heap-based buffer overflow vulnerability exists in the DrayTek Vigor2960 (version 1.5.1.6) within the File Existence Check component. The issue is located in the check_file_exist function of the /cgi-bin/mainfunction.cgi file, where manipulating the upload_name argument can trigger the overflow...

EUVD-2026-126031

A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function checkfileexist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument uploadname results in heap-based buffer overflow. The attack may be initiat...

EUVD-2026-126018

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6. This vulnerability affects the function settable of the file /cgi-bin/mainfunction.cgi. Such manipulation of the argument jsondata leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-129452

The DrayTek Vigor2960 (version 1.5.1.6 ) is vulnerable to a remote command injection vulnerability in the set_table function of the /cgi-bin/mainfunction.cgi file. This flaw occurs when the jsondata argument is improperly handled, allowing an attacker to execute arbitrary commands remotely. The e...

CVE-2026-129451

The DrayTek Vigor2960 (versions up to 1.5.1.6 ) is vulnerable to a path traversal flaw in the app_guest_export function of the /cgi-bin/mainfunction.cgi file. This vulnerability occurs due to improper manipulation of the filename argument, allowing for remote attacks. Public exploits have been pu...

EUVD-2026-126017

A flaw has been found in DrayTek Vigor2960 up to 1.5.1.6. This affects the function appguestexport of the file /cgi-bin/mainfunction.cgi. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgradi...

CVE-2026-129450

A path traversal vulnerability exists in the DrayTek Vigor2960 (version 1.5.1.6) within the sub_1E084 function of the /cgi-bin/mainfunction.cgi?action=doWebBackup file. Attackers can exploit this by manipulating the option argument to access files outside the intended directory. This vulnerabilit...

EUVD-2026-126014

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6. Affected by this issue is the function sub1E084 of the file /cgi-bin/mainfunction.cgi?action=doWebBackup. The manipulation of the argument option results in path traversal. It is possible to launch the attack remotely. The exploit is now...

CVE-2026-129449

The DrayTek Vigor2960 router (up to version 1.5.1.6 ) is vulnerable to a command injection flaw. The issue resides in the sub_14914 function within the /cgi-bin/mainfunction.cgi file, where improper handling of the swmconfigupload argument allows for remote execution. This vulnerability has been ...

EUVD-2026-126013

A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function sub14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload leads to command injection. It is possible to initiate the attack remotely...

draytek-arsenal

Draytek Arsenal: Observability and hardening toolkit for Draytek edge devices. Advanced attackers are increasingly choosing edge devices as targets. However, these devices are controlled by closed-source software known as firmware, often distributed in a proprietary format. This is an added...

nmap_draytek_rce

nmapdraytekrce nmap script to detect CVE-2020-8515 on Draytek Devices...

CVE-2020-8515

CVE-2020-8515 Draytek CVE-2020-8515 PoC I had kicking about. Amusingly, the command injected gets executed twice, see here: $ ./draytek.py draytek.local executing command: cat /etc/passwd + vulnerable! executing command: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar 28 00:49:28 CST 2018 armv6l...

Draytek VigorConnect 1.6.0-B - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id:...

Draytek VigorConnect 6.0-B3 - Local File Inclusion

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. id: CVE-2021-201...

DrayTek Vigor - Command Injection

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. id: CVE-2020-15415 info: name:...

DrayTek Vigor - Command Injection

DrayTek Gateway devices Vigor2960, Vigor300B, etc. are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output. id: CVE-2024-12987 info: name: DrayTek Vigor - Command...

VulnCheck KEV: CVE-2021-42911

A Format String vulnerability exists in DrayTek Vigor 2960 = 1.5.1.3, DrayTek Vigor 3900 = 1.5.1.3, and DrayTek Vigor 300B = 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code...