410526 matches found
CVE-2026-71919
Multiple DrayTek VigorSwitch models contain an OS command injection vulnerability in the sysreboot function, caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker with valid administrative credentials for the device's web managem...
EUVD-2026-64978
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input ...
CVE-2026-71917
Multiple DrayTek VigorSwitch models are affected by an OS command injection in the pingtrace function, caused by insufficient validation of the host field before command execution. An attacker with valid administrative credentials for the device's web management interface can supply crafted input...
EUVD-2026-64977
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pwencode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability vi...
CVE-2026-71917 DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...
CVE-2026-71918 DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pwencode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability vi...
CVE-2026-71917 DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...
CVE-2026-71918
Multiple DrayTek VigorSwitch models are affected by an OS command injection vulnerability in the webBackupAction function. The root cause is insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution, allowing a remote attacker with valid administrativ...
EUVD-2026-64976
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...
CVE-2026-71916
Multiple DrayTek VigorSwitch models are affected by an OS command injection vulnerability in the commandTable function. The root cause is incomplete filtering of dangerous characters—specifically backticks, newline characters, and single quotes—within the parameter field, allowing a remote attack...
CVE-2026-71916 DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger th...
EUVD-2026-64975
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger th...
CVE-2026-71914 DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...
CVE-2026-71915 DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input...
CVE-2026-71915
Multiple DrayTek VigorSwitch models contain an OS command injection vulnerability in the jsonstatus function. The root cause is insufficient filtering of the usescript , usefile , and option fields before they are passed to command execution, allowing a remote attacker with valid administrative c...
EUVD-2026-64973
Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...
CVE-2026-71914 DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...
CVE-2026-71915 DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input...
CVE-2026-71914
Multiple DrayTek VigorAP models are affected by a pre-authentication OS command injection in the dray_apm component. The root cause is insufficient validation of UDP message content following the START_SPEED_TEST event before command execution, allowing a remote unauthenticated attacker to send a...
EUVD-2026-64974
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input...