DrayTek VigorACS SI 1.3.0 - Multiple Vulnerabilities

DrayTek VigorACS SI /ACSServer/ We found that most of the VigorACS SI deployments are using the default http authentication settings acs/password. This is not so much a software vulnerability but more a configuration issue. 2.2 Unauthenticated arbitrary file read/write functionality via...

DrayTek VigorACS SI 1.3.0 File Write / LFI / File Upload

DrayTek VigorACS SI /ACSServer/ We found that most of the VigorACS SI deployments are using the default http authentication settings acs/password. This is not so much a software vulnerability but more a configuration issue. 2.2 Unauthenticated arbitrary file read/write functionality via...

Draytek Vigor 3900 1.06 - Privilege Escalation

No description provided by source...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

Code injection

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

CVE-2013-5703

The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js...

CVE-2013-5703

CVE-2013-5703 affects the DrayTek Vigor 2700 router (notably v2.8.3) where a crafted SSID value is mishandled when inserted into the sWlessSurvey list in variables.js. This enables remote attackers to execute arbitrary JavaScript in the router’s web administration context and to modify settings o...

DrayTek Vigor 2700 ADSL router contains a command injection vulnerability

Overview DrayTek Vigor 2700 ADSL router version 2.8.3 and possibly earlier versions contain a command injection vulnerability via malicious SSID CWE-77. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' DrayTek Vigor 2700 ADSL router version 2.8...

Draytek Vigor 3900 1.06 - Local Privilege Escalation

Exploit Title: Previlege escalation Date: 19/3/2013 Exploit Author: Mohammad abou hayt Vendor Homepage: http://www.draytek.com.tw/index.php?option=comk2&view=item&layout=item&id=2627&Itemid=593&lang=en Software Link: N/A Version: Vigor 3900 -Hardware V2 - firmware latest 1.06 Privilege escalation...

Draytek Vigor 3900 1.06 - Local Privilege Escalation

Draytek Vigor 3900 1.06 - Local Privilege Escalation Exploit Title: Previlege escalation Date: 19/3/2013 Exploit Author: Mohammad abou hayt Vendor Homepage: http://www.draytek.com.tw/index.php?option=comk2&view=item&layout=item&id=2627&Itemid=593&lang=en Software Link: N/A Version: Vigor 3900...

Draytek Vigor 3900 1.06 - Privilege Escalation

Exploit for hardware platform in category local exploits Affected device Description: Vigor 3900 Router Firewall : High Performance Multi-WAN VPN Appliance The Vigor 3900 is a high-performance quad-Gigabit WAN router for high-performance applications including remote access, firewalling,...

Draytek Website - Remote SQL Injection Vulnerability

Document Title: =============== Draytek Website - Remote SQL Injection Vulnerability Release Date: ============= 2011-07-17 Vulnerability Laboratory ID VL-ID: ==================================== 124 Product & Service Introduction: =============================== DrayTek , established in 1997 by ...

Draytek Website - Remote SQL Injection Vulnerability

Document Title: =============== Draytek Website - Remote SQL Injection Vulnerability Release Date: ============= 2011-07-17 Vulnerability Laboratory ID VL-ID: ==================================== 124 Product & Service Introduction: =============================== DrayTek , established in 1997 by ...

Unfixed XSS vulnerability at www.draytek.com

Security researcher alexalghisi, has submitted on 07/11/2010 a cross-site-scripting XSS vulnerability affecting www.draytek.com, which at the time of submission ranked 141664 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...