Draytek VigorConnect Path Traversal Vulnerability

Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

Draytek VigorConnect Path Traversal Vulnerability

Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

CVE-2024-43027

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...

CVE-2024-43027

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...

CVE-2024-43027

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...

PT-2024-30260 · Draytek · Draytek Vigor300B +2

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 3900 versions prior to v1.5.1.5 Beta DrayTek Vigor 2960 versions prior to v1.5.1.5 Beta DrayTek Vigor 300B versions prior to v1.5.1.5 Beta Description: A command injection vulnerability was discovered via the action parameter at...

CVE-2024-43027

Affected products: DrayTek Vigor 3900, 2960, and 300B with versions prior to 1.5.1.5_Beta. Vulnerability: command injection via the action parameter in cgi-bin/mainfunction.cgi, as reported by multiple sources. Root cause: input in the action parameter allows execution of arbitrary commands on th...

DrayTek Vigor多款产品 安全漏洞

DrayTek Vigor 3900 and others are products of China DrayTek DrayTek.DrayTek Vigor 3900 is a broadband router/VPN gateway device.DrayTek Vigor 2960 is a dual-WAN broadband router/VPN gateway.DrayTek Vigor 300B is a Quad-WAN load balanced broadband router running on DrayTek Vigor 300B is a Quad-WAN...

CVE-2024-43027

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...

VulnCheck KEV: CVE-2021-20123

Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

PT-2024-7670 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 devices through 4.3.2.6 Description: The issue is an unauthenticated DOM-based reflected XSS. This occurs due to a lack of protection for the web page structure in the DrayTek Vigor router's web interface firmware...

Cisco Warns of Global Surge in Brute-Force Attacks Targeting VPN and SSH Services

Cisco is warning about a global surge in brute-force attacks targeting various devices, including Virtual Private Network VPN services, web application authentication interfaces, and SSH services, since at least March 18, 2024. "These attacks all appear to be originating from TOR exit nodes and a...

Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials

Cisco Talos would like to acknowledge Anna Bennett and Brandon White of Cisco Talos and Phillip Schafer, Mike Moran, and Becca Lynch of the Duo Security Research team for their research that led to the identification of these attacks. Cisco Talos is actively monitoring a global increase in...

CVE-2024-23721

A Directory Traversal issue was discovered in processpost on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information...

CVE-2024-23721

A Directory Traversal issue was discovered in processpost on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information...

DrayTek Vigor routers 安全漏洞

DrayTek Vigor routers are a series of routers from Taiwan's DrayTek Corporation DrayTek. A security vulnerability exists in Draytek Vigor3910 4.3.2.5 and earlier versions, which stems from a directory traversal vulnerability in processpost...

CVE-2024-23721

A Directory Traversal issue was discovered in processpost on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information...

CVE-2024-23721

A Directory Traversal issue was discovered in processpost on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information...

PT-2024-20034 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3910 version 4.3.2.5 Description: A Directory Traversal issue was discovered in the process post function. When sending a certain POST request, it calls the function and exports information. Recommendations: For Draytek Vigor3910...

CVE-2024-23721

CVE-2024-23721 concerns a Directory Traversal in the Draytek Vigor3910, specifically in the process_post function. Affected product/version: Draytek Vigor3910 4.3.2.5 and earlier. The issue is triggered by a crafted POST request that causes the function to export information, indicating a potenti...