CVE-2024-41340

The CVE-2024-41340 issue affects multiple Draytek Vigor devices, where an attacker can upload crafted APP Enforcement modules, leading to arbitrary code execution. Affected models and minimum patched versions include: Vigor 165/166 before 4.2.6 (update to 4.2.6+), Vigor 2620/LTE200 before 3.9.8.8...

CVE-2024-51138

Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier;...

PT-2025-9023

Name of the Vulnerable Software and Affected Versions Draytek Vigor 165/166 versions prior to 4.2.6 Draytek Vigor 2620/LTE200 versions prior to 3.9.8.8 Draytek Vigor 2860/2925 versions prior to 3.9.7 Draytek Vigor 2862/2926 versions prior to 3.9.9.4 Draytek Vigor 2133/2762/2832 versions prior to...

VulnCheck KEV: CVE-2024-12987

DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface...

CVE-2022-32548

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field...

DrayTek Vigor 1.5.1.1 (CVE-2020-19664)

The version of DrakTek Vigor installed on the remote host is prior to 1.5.1.1. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-19664 advisory. - DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

CVE-2024-12987

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command...

CVE-2024-12987

A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command...

The vulnerability in the mainfunction.cgii web interface of DrayTek Vigor software allows a hacker to execute arbitrary code.

The vulnerability in the mainfunction.cgii web interface of the DrayTek Vigor router software lies in the issue of buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code during the processing of the formuserphonenumber parameter...

The vulnerability of the `ldap_search_dn` function in the `mainfunction.cgi` script of the DrayTek Vigor router’s web interface allows a hacker to execute arbitrary commands.

The vulnerability of the ldapsearchdn function in the mainfunction.cg script of the DrayTek Vigor router’s web interface is related to the lack of measures taken at the control level to clean data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the chglog.cgi web interface of the DrayTek Vigor router software allows a attacker to trigger a Denial-of-Service Attack (DoS).

The vulnerability of the chglog.cgi web interface of the DrayTek Vigor router software lies in the buffer overflow that occurs during the processing of the CGIbyFieldName parameter. Exploiting this vulnerability allows an attacker to trigger a Denial-of-Service attack from a remote location...

The vulnerability in the mainfunction.cgii web interface of DrayTek Vigor software allows a hacker to execute arbitrary code.

The vulnerability in the mainfunction.cgii web interface of the DrayTek Vigor router software exists due to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability in the Profile Name field of the software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network allows a attacker to perform XSS attacks.

The vulnerability of the Profile Name field in software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability cou...

The vulnerability in the mainfunction.cgii web interface of the DrayTek Vigor router software allows a hacker to inject any command they desire.

The vulnerability in the mainfunction.cgii web interface of the DrayTek Vigor router software exists due to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands remotely...

The vulnerability of the web interface of Draytek Vigor routers, Draytek Vigor access points, Draytek Vigor switches, and the cloud platform Draytek Vigor Myvigor arises from the use of rigidly encrypted credentials. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the web interface of Draytek Vigor routers, Draytek Vigor access points, Draytek Vigor switches, and the cloud platform Draytek Vigor Myvigor is related to the use of rigidly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to compromise the...

The vulnerability of the sub_1DF14 function in the mainfunction.cgi web interface of the DrayTek Vigor router software allows a hacker to gain unauthorized access to confidential system files.

The vulnerability of the sub1DF14 function in the mainfunction.cgi web interface of the DrayTek Vigor router software is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...

The vulnerability of the vpn.cgi web interface script of the DrayTek Vigor router software allows a hacker to trigger a service failure.

The vulnerability of the vpn.cgi web interface of the DrayTek Vigor router operating system is related to buffer overflow during the processing of the sPeerId parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

The vulnerability of the web interface of DrayTek Vigor microprogramming software-enabled routers allows a hacker to execute a CSRF attack.

The vulnerability of the web interface of DrayTek Vigor microprogramming software lies in the possibility of inter-site requests being forged. Exploiting this vulnerability allows a remote attacker to execute a CSRF attack...

The vulnerability in the mainfunction.cgii web interface of DrayTek Vigor software allows a hacker to execute arbitrary code.

The vulnerability in the mainfunction.cgii web interface of the DrayTek Vigor router software system involves the use of uncontrolled format strings. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the user_login.cgi web interface of the DrayTek Vigor router software allows a hacker to execute arbitrary code.

The vulnerability of the userlogin.cgi web interface of the DrayTek Vigor router software lies in improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...