CVE-2020-8515

CVE-2020-8515 affects DrayTek Vigor2960, Vigor3900 and Vigor300B devices (various Beta firmware versions) via the cgi-bin/mainfunction.cgi endpoint. The root cause is unsafely processed shell metacharacters in POST requests, enabling remote code execution with root privileges without authenticati...

CVE-2024-12987

CVE-2024-12987 affects DrayTek Vigor2960 and Vigor300B running firmware 1.5.1.4, where the Web Management Interface endpoint /cgi-bin/mainfunction.cgi/apmcfgupload processes the session parameter in an insecure way, enabling OS command injection. The issue is exploitable remotely and has public e...

CVE-2020-15415

DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 are affected by CVE-2020-15415. The issue is an OS command injection in /cgi-bin/mainfunction.cgi/cvmcfgupload that allows remote code execution via shell metacharacters in a filename when the request uses content type text/x-python...

CVE-2020-10828

CVE-2020-10828 is a stack-based buffer overflow in the cvmd process on DrayTek Vigor3900, Vigor2960, and Vigor300B devices. Versions prior to 1.5.1 are affected and allow remote code execution via a crafted remote HTTP request. This is confirmed by multiple sources in connected documents (vendor ...

CVE-2020-10826

CVE-2020-10826 affects DrayTek Vigor3900, Vigor2960, and Vigor300B before version 1.5.1. The issue allows remote command injection via a crafted HTTP request to /cgi-bin/activate.cgi when DEBUG mode is enabled, enabling an attacker to execute arbitrary commands on affected devices. The root cause...

CVE-2020-10827

CVE-2020-10827 refers to a stack-based buffer overflow in the apmd service on Draytek Vigor3900, Vigor2960, and Vigor300B devices. The vulnerability, present in firmware prior to 1.5.1, allows remote code execution via a crafted HTTP request. Multiple connected sources corroborate the affected mo...

CVE-2020-14472

CVE-2020-14472 affects DrayTek Vigor3900, Vigor2960, and Vigor300B devices prior to version 1.5.1.1. The issue is in the mainfunction.cgi component and enables command injection. This could lead to remote code execution on affected devices, as noted in the advisory context. No exploitation status...

CVE-2021-43118

CVE-2021-43118 affects DrayTek Vigor 2960, 3900, and 300B (firmware 1.5.1.3). A remote command injection arises from inadequate validation in mainfunction.cgi when handling crafted HTTP queries with a malformed QUERY STRING, enabling arbitrary code execution by a remote attacker over the network....

CVE-2023-24229

Summary: CVE-2023-24229 affects DrayTek Vigor2960 (v1.5.1.4). An authenticated attacker with network access to the device’s web management interface can inject operating system commands through the mainfunction.cgi parameter, enabling arbitrary command execution. This vulnerability exists in a de...

CVE-2020-19664

Conflict-free summary (CVE-2020-19664): Affects DrayTek Vigor2960 firmware, notably 1.5.1, where remote command execution is possible via shell metacharacters in a toLogin2FA action directed at mainfunction.cgi. Root cause: failure to neutralize shell metacharacters in the toLogin2FA path. Conseq...

CVE-2024-43027

Affected products: DrayTek Vigor 3900, 2960, and 300B with versions prior to 1.5.1.5_Beta. Vulnerability: command injection via the action parameter in cgi-bin/mainfunction.cgi, as reported by multiple sources. Root cause: input in the action parameter allows execution of arbitrary commands on th...

CVE-2024-12986

DrayTek Vigor2960/Vigor300B Web Management Interface (versions 1.5.1.3–1.5.1.4) contain a command-injection vulnerability in the /cgi-bin/mainfunction.cgi/apmcfgupptim endpoint where the session parameter is manipulated to achieve OS command execution. Exploitation can be remote and has been disc...

CVE-2021-42911

CVE-2021-42911 is a Format String vulnerability in DrayTek Vigor routers (models 2960, 3900, 300B) ≤ 1.5.1.3, exploitable via crafted HTTP messages with malformed QUERY STRING in the mainfunction.cgi. The CNVD/NVD entries describe remote code execution risk with network access and low attack comp...

CVE-2020-10825

CVE-2020-10825 affects DrayTek Vigor3900, Vigor2960, and Vigor300B prior to firmware version 1.5.1. The issue is a stack-based buffer overflow in the /cgi-bin/activate.cgi endpoint during base64 decoding of the ticket parameter, which can enable remote code execution via a remote HTTP request. Th...

CVE-2020-10824

Affected devices: DrayTek Vigor3900, Vigor2960, and Vigor300B. Vulnerable version range: prior to 1.5.1. Vulnerability type & impact: stack-based buffer overflow in the "/cgi-bin/activate.cgi" API endpoint via the ticket parameter that allows remote attackers to achieve code execution through a r...

CVE-2020-10823

CVE-2020-10823 affects DrayTek Vigor3900, Vigor2960, and Vigor300B devices running versions prior to 1.5.1. A stack-based buffer overflow exists in the /cgi-bin/activate.cgi endpoint through the var parameter, allowing remote attackers to achieve code execution via a remote HTTP request (issue 1 ...

CVE-2024-48074

DrayTek Vigor2960 (v1.4.4) exposes an authorized RCE via the table parameter in the doPPPoE function (cgi-bin/mainfunction.cgi); an attacker can inject a command that is executed by the system function. Impact is high per CVSS metrics. Remediation/workaround from PT-2024-7515: temporarily disable...

CVE-2020-14473

CVE-2020-14473 is a stack-based buffer overflow affecting DrayTek Vigor3900, Vigor2960, and Vigor300B devices with firmware prior to 1.5.1.1. The connected sources consistently identify the issue as a stack overflow in the affected devices, enabling potential arbitrary code execution and impact t...

CVE-2020-14993

CVE-2020-14993 affects DrayTek Vigor2960, Vigor3900, and Vigor300B devices with firmware before 1.5.1.1. The vulnerability is a stack-based buffer overflow in the formuserphonenumber parameter of an authusersms action to mainfunction.cgi, enabling remote code execution. Public exploit status is n...

CVE-2023-6265

DrayTek Vigor2960 (versions 1.5.1.4–1.5.1.5) is affected by a directory traversal vulnerability in the mainfunction.cgi dumpSyslog option parameter. An authenticated attacker with access to the web management interface can delete arbitrary files on the device. The vulnerability affects only these...

CVE-2023-1009

DrayTek Vigor 2960 Web Management Interface contains a path traversal vulnerability in the function sub_1DF14 of /cgi-bin/mainfunction.cgi. Exploitation arises by manipulating the option argument with the input /../etc/passwd-, enabling remote access to sensitive files. Affected versions are 1.5....