CVE-2020-8515

CVE-2020-8515 affects DrayTek Vigor2960, Vigor3900 and Vigor300B devices (various Beta firmware versions) via the cgi-bin/mainfunction.cgi endpoint. The root cause is unsafely processed shell metacharacters in POST requests, enabling remote code execution with root privileges without authenticati...

CVE-2024-12987

CVE-2024-12987 affects DrayTek Vigor2960 and Vigor300B running firmware 1.5.1.4, where the Web Management Interface endpoint /cgi-bin/mainfunction.cgi/apmcfgupload processes the session parameter in an insecure way, enabling OS command injection. The issue is exploitable remotely and has public e...

CVE-2020-15415

DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 are affected by CVE-2020-15415. The issue is an OS command injection in /cgi-bin/mainfunction.cgi/cvmcfgupload that allows remote code execution via shell metacharacters in a filename when the request uses content type text/x-python...

CVE-2020-10828

CVE-2020-10828 is a stack-based buffer overflow in the cvmd process on DrayTek Vigor3900, Vigor2960, and Vigor300B devices. Versions prior to 1.5.1 are affected and allow remote code execution via a crafted remote HTTP request. This is confirmed by multiple sources in connected documents (vendor ...

CVE-2020-10826

CVE-2020-10826 affects DrayTek Vigor3900, Vigor2960, and Vigor300B before version 1.5.1. The issue allows remote command injection via a crafted HTTP request to /cgi-bin/activate.cgi when DEBUG mode is enabled, enabling an attacker to execute arbitrary commands on affected devices. The root cause...

CVE-2020-10827

CVE-2020-10827 refers to a stack-based buffer overflow in the apmd service on Draytek Vigor3900, Vigor2960, and Vigor300B devices. The vulnerability, present in firmware prior to 1.5.1, allows remote code execution via a crafted HTTP request. Multiple connected sources corroborate the affected mo...

CVE-2020-14472

CVE-2020-14472 affects DrayTek Vigor3900, Vigor2960, and Vigor300B devices prior to version 1.5.1.1. The issue is in the mainfunction.cgi component and enables command injection. This could lead to remote code execution on affected devices, as noted in the advisory context. No exploitation status...

CVE-2023-24229

The DrayTek Vigor2960 (version 1.5.1.4 ) contains a command injection vulnerability in the mainfunction.cgi component. An authenticated attacker with network access to the web management interface can inject and execute arbitrary operating system commands by exploiting the 'parameter' parameter d...

CVE-2021-43118

CVE-2021-43118 affects DrayTek Vigor 2960, 3900, and 300B (firmware 1.5.1.3). A remote command injection arises from inadequate validation in mainfunction.cgi when handling crafted HTTP queries with a malformed QUERY STRING, enabling arbitrary code execution by a remote attacker over the network....

CVE-2020-19664

Conflict-free summary (CVE-2020-19664): Affects DrayTek Vigor2960 firmware, notably 1.5.1, where remote command execution is possible via shell metacharacters in a toLogin2FA action directed at mainfunction.cgi. Root cause: failure to neutralize shell metacharacters in the toLogin2FA path. Conseq...

CVE-2024-43027

DrayTek Vigor 3900 , Vigor 2960 , and Vigor 300B routers (versions prior to v1.5.1.5_Beta ) are susceptible to a command injection vulnerability. The flaw exists in the action parameter of the cgi-bin/mainfunction.cgi endpoint, potentially allowing for unauthorized access or system control. Remed...

CVE-2024-12986

DrayTek Vigor2960/Vigor300B Web Management Interface (versions 1.5.1.3–1.5.1.4) contain a command-injection vulnerability in the /cgi-bin/mainfunction.cgi/apmcfgupptim endpoint where the session parameter is manipulated to achieve OS command execution. Exploitation can be remote and has been disc...

CVE-2021-42911

CVE-2021-42911 is a Format String vulnerability in DrayTek Vigor routers (models 2960, 3900, 300B) ≤ 1.5.1.3, exploitable via crafted HTTP messages with malformed QUERY STRING in the mainfunction.cgi. The CNVD/NVD entries describe remote code execution risk with network access and low attack comp...

CVE-2020-10825

CVE-2020-10825 affects DrayTek Vigor3900, Vigor2960, and Vigor300B prior to firmware version 1.5.1. The issue is a stack-based buffer overflow in the /cgi-bin/activate.cgi endpoint during base64 decoding of the ticket parameter, which can enable remote code execution via a remote HTTP request. Th...

CVE-2020-10824

Affected devices: DrayTek Vigor3900, Vigor2960, and Vigor300B. Vulnerable version range: prior to 1.5.1. Vulnerability type & impact: stack-based buffer overflow in the "/cgi-bin/activate.cgi" API endpoint via the ticket parameter that allows remote attackers to achieve code execution through a r...

CVE-2020-10823

CVE-2020-10823 affects DrayTek Vigor3900, Vigor2960, and Vigor300B devices running versions prior to 1.5.1. A stack-based buffer overflow exists in the /cgi-bin/activate.cgi endpoint through the var parameter, allowing remote attackers to achieve code execution via a remote HTTP request (issue 1 ...

CVE-2024-48074

The DrayTek Vigor2960 router (version 1.4.4 ) is vulnerable to Remote Code Execution (RCE) due to the improper neutralization of special elements used in operating system commands. An attacker can inject a specially crafted command into the table parameter of the doPPPoE function located in the c...

CVE-2020-14473

CVE-2020-14473 is a stack-based buffer overflow affecting DrayTek Vigor3900, Vigor2960, and Vigor300B devices with firmware prior to 1.5.1.1. The connected sources consistently identify the issue as a stack overflow in the affected devices, enabling potential arbitrary code execution and impact t...

CVE-2020-14993

CVE-2020-14993 affects DrayTek Vigor2960, Vigor3900, and Vigor300B devices with firmware before 1.5.1.1. The vulnerability is a stack-based buffer overflow in the formuserphonenumber parameter of an authusersms action to mainfunction.cgi, enabling remote code execution. Public exploit status is n...

CVE-2023-1009

DrayTek Vigor 2960 Web Management Interface contains a path traversal vulnerability in the function sub_1DF14 of /cgi-bin/mainfunction.cgi. Exploitation arises by manipulating the option argument with the input /../etc/passwd-, enabling remote access to sensitive files. Affected versions are 1.5....

CVE-2023-6265

DrayTek Vigor2960 (versions 1.5.1.4–1.5.1.5) is affected by a directory traversal vulnerability in the mainfunction.cgi dumpSyslog option parameter. An authenticated attacker with access to the web management interface can delete arbitrary files on the device. The vulnerability affects only these...