Draytek vulnerabilities, page 3

144 vulnerabilities

Known vulnerabilities in Draytek products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 143 products.

8HighCVE-2024-41590draytek · vigor1000b_firmware +12 moredraytek vigor1000b_firmwareSeveral CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.EPSS0.33%8.8HighCVE-2024-41339draytek · vigor165_firmware +19 moredraytek vigor165_firmwareAn issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution.EPSS0.65%8HighCVE-2024-41588draytek · vigor1000b_firmware +12 moredraytek vigor1000b_firmwareThe CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function.EPSS0.33%8.8HighCVE-2024-41589draytek · vigor3910_firmwaredraytek vigor3910_firmwareDrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.EPSS0.32%8HighCVE-2024-41592draytek · vigor1000b_firmware +23 moredraytek vigor1000b_firmwareDrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.EPSS1.40%8HighCVE-2024-41586draytek · vigor3910_firmwaredraytek vigor3910_firmwareA stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component.EPSS0.46%6.1MediumCVE-2024-41591draytek · vigor1000b_firmware +12 moredraytek vigor1000b_firmwareDrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.EPSS0.27%8.8HighCVE-2024-41334draytek · vigor165_firmware +19 moredraytek vigor165_firmwareDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to not utilize certificate verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution.EPSS0.38%8HighCVE-2024-41596draytek · vigor1000b_firmware +12 moredraytek vigor1000b_firmwareBuffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters.EPSS0.33%4.7MediumCVE-2024-41584draytek · vigor3910_firmwaredraytek vigor3910_firmwareDrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter.EPSS0.30%7.5HighCVE-2024-41338draytek · vigor165_firmware +19 moredraytek vigor165_firmwareA NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request.EPSS0.45%6.8MediumCVE-2024-41585draytek · vigor3910_firmwaredraytek vigor3910_firmwareDrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escape from the emulated instance and inject arbitrary commands into the host machine.EPSS0.78%5.4MediumCVE-2024-41587draytek · vigor1000b_firmware +12 moredraytek vigor1000b_firmwareStored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.EPSS0.25%4.7MediumCVE-2024-41583draytek · vigor3910_firmwaredraytek vigor3910_firmwareDrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitization of the router name.EPSS0.30%9.8CriticalCVE-2024-41593draytek · vigor1000b_firmware +12 moredraytek vigor1000b_firmwareDrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.EPSS0.89%8.8HighCVE-2024-51257draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.EPSS0.39%8HighCVE-2024-51246draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.EPSS0.43%9.8CriticalCVE-2024-51139draytek · vigor1000b_firmware +22 moredraytek vigor1000b_firmwareBuffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.EPSS1.00%8.8HighCVE-2024-51299draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.EPSS0.61%8.8HighCVE-2024-51300draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.EPSS0.61%