DrayTek Vigor Stack Buffer Overflow (CVE-2020-10824; CVE-2020-10825)

A stack buffer overflow vulnerability exists in DrayTek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

CVE-2020-14472

On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file...

CVE-2020-14472

On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file...

CVE-2020-14472

CVE-2020-14472 affects DrayTek Vigor3900, Vigor2960, and Vigor300B devices prior to version 1.5.1.1. The issue is in the mainfunction.cgi component and enables command injection. This could lead to remote code execution on affected devices, as noted in the advisory context. No exploitation status...

CVE-2020-14993

A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi...

Draytek Vigor Command Injection (CVE-2020-8515)

A command injection vulnerability exists in Draytek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Command Injection Vulnerability in DrayTek Vigor Series Routers

The DrayTek Vigor Series routers are dual WAN port security firewall routers designed for mid-sized businesses. A command injection vulnerability exists in the DrayTek Vigor Series routers, which can be exploited by an attacker to execute arbitrary commands to gain privileges on the router...

DrayTek Vigor Detection (Telnet)

Telnet based detection of DrayTek Vigor devices. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DrayTek Vigor Detection (FTP)

Detection of DrayTek Vigor devices via FTP. The script attempts to identify a DrayTek Vigor device via a FTP banner. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GN...

PT-2020-6990 · Draytek · Draytek Vigor2960 +2

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900, Vigor2960, and Vigor300B devices versions prior to 1.5.1 Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a remote attacker to execut...

PT-2020-6999 · Draytek · Draytek Vigor2960 +2

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor2960 versions prior to 1.5.1.1 DrayTek Vigor3900 versions prior to 1.5.1.1 DrayTek Vigor300B versions prior to 1.5.1.1 Description: The issue is related to a stack-based buffer overflow in the mainfunction.cgi script of the DrayT...

DrayTek Vigor Devices 'CVE-2018-20872' CSRF Vulnerability

Multiple DrayTek Vigor Routers are prone to a cross-site request forgery CSRF vulnerability. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License...

DrayTek Vigor2700 Series < 2.8.4 Javascript Injection Vulnerability

Multiple DrayTek Vigor Routers are prone to a javascript injection vulnerability. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as publish...

DrayTek Vigor Detection (PPTP)

PPTP based detection of DrayTek Vigor devices. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DrayTek Vigor2960 / Vigor3900 / Vigor300B Remote Command Execution

package main / CVE-2020-8515: DrayTek pre-auth remote root RCE Mon Mar 30 2020 - 0xsha.io Affected: DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta You should upgrade as soon as possible to 1.5.1 firmware or later This issue has been fixed in...

DrayTek Vigor Detection (HTTP)

HTTP based detection of DrayTek Vigor devices. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DrayTek Vigor Detection (SNMP)

Detection of DrayTek Vigor devices. This script performs SNMP based detection of DrayTek Vigor devices. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

DrayTek Vigor Detection Consolidation

Consolidation of DrayTek Vigor device detections. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Exploit for OS Command Injection in Draytek Vigor2960_Firmware

CVE-2...

Hackers Exploit Zero-Day Bugs in Draytek Devices to Target Enterprise Networks

Cybersecurity researchers with Qihoo 360's NetLab today unveiled details of two recently spotted zero-day cyberattack campaigns in the wild targeting enterprise-grade networking devices manufactured by Taiwan-based DrayTek. According to the report, at least two separate groups of hackers exploite...