CVE-2021-43118

A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code...

Format string

A Format String vulnerability exists in DrayTek Vigor 2960 = 1.5.1.3, DrayTek Vigor 3900 = 1.5.1.3, and DrayTek Vigor 300B = 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code...

Command injection

A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code...

CVE-2021-43118

CVE-2021-43118 affects DrayTek Vigor 2960, 3900, and 300B (firmware 1.5.1.3). A remote command injection arises from inadequate validation in mainfunction.cgi when handling crafted HTTP queries with a malformed QUERY STRING, enabling arbitrary code execution by a remote attacker over the network....

CVE-2021-43118

A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code...

CVE-2021-42911

A Format String vulnerability exists in DrayTek Vigor 2960 = 1.5.1.3, DrayTek Vigor 3900 = 1.5.1.3, and DrayTek Vigor 300B = 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code...

CVE-2021-42911

CVE-2021-42911 is a Format String vulnerability in DrayTek Vigor routers (models 2960, 3900, 300B) ≤ 1.5.1.3, exploitable via crafted HTTP messages with malformed QUERY STRING in the mainfunction.cgi. The CNVD/NVD entries describe remote code execution risk with network access and low attack comp...

多款 DrayTek Vigor 产品命令注入漏洞

DrayTek Vigor is a router. A remote command injection vulnerability exists in DrayTek Vigor, which can be exploited by attackers to allow a remote malicious user to execute arbitrary code via a crafted HTTP message containing a malformed query string in mainfunction.cgi...

Draytek多款产品格式化字符串错误漏洞

DrayTek Vigor is a router. a format string vulnerability exists in DrayTek Vigor, which can be exploited by remote attackers to execute arbitrary code via specially crafted HTTP messages containing malformed query strings...

VulnCheck KEV: CVE-2020-10827

A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request...

The vulnerability of the WebUI interface of Vigor3900 / Vigor2960 / Vigor300B routers allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the WebUI interface of Vigor3900/Vigor2960/Vigor300B routers lies in the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

PT-2021-8205 · Draytek · Draytek Vigor300B +2

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 2960 version 1.5.1.3 DrayTek Vigor 3900 version 1.5.1.3 DrayTek Vigor 300B version 1.5.1.3 Description: A Remote Command Injection issue exists in the mainfunction.cgi script of the DrayTek Vigor web interface due to inadequate...

PT-2021-8206 · Draytek · Draytek Vigor300B +2

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 2960 versions 1.5.1.3 and earlier DrayTek Vigor 3900 versions 1.5.1.3 and earlier DrayTek Vigor 300B versions 1.5.1.3 and earlier Description: The issue is related to a Format String vulnerability in the mainfunction.cgi file of...

Logic Flaw Vulnerability in Vigor Series Products

Shanghai Juyi Technology Development Co., Ltd, Legal Representative: Wang Nan, Registered Capital: 1,000,000 yuan, Address: JT1225, Room 2201, No. 888, Moyu South Road, Anting Town, Jiading District, Shanghai, Business Scope: General Items: technical services, technology development, technology...

Command Injection Vulnerability in DrayTek Vigor 2960/3900/300B VPN Firewalls

The DrayTek Vigor Series routers are dual WAN port security firewall routers designed for mid-sized businesses. A command injection vulnerability exists in the DrayTek Vigor 2960/3900/300B VPN Firewall, which can be exploited by an attacker to execute arbitrary commands to gain privileges on the...

DrayTek Vigor Detection

Binary data draytekvigordetect.nbin...

DrayTek Vigor < 1.5.1 Unauthenticated RCE (Direct Check)

Nessus was able to exploit an un-authenticated remote command execution vulnerability on the web adminstration UI on the remote router and was able to retrieve the contents of /etc/passwd. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid141781; scriptversion"1.6";...

DrayTek Vigor Buffer Overflow (CVE-2020-14473)

A buffer overflow vulnerability exists in DrayTek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

DrayTek Vigor Remote Code Execution (CVE-2020-14472)

A remote code execution vulnerability exists in DrayTek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

DrayTek Vigor Stack Buffer Overflow (CVE-2020-10823)

A stack buffer overflow vulnerability exists in DrayTek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...