Draytek vulnerabilities, page 4
144 vulnerabilities
Known vulnerabilities in Draytek products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 143 products.
CriticalCVE-2024-51259draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function.EPSS0.35%HighCVE-2024-51254draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function.EPSS0.43%HighCVE-2024-51253draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.EPSS0.69%CriticalCVE-2024-51255draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function.EPSS0.39%HighCVE-2024-51244draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function.EPSS0.81%HighCVE-2024-51247draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function.EPSS0.81%HighCVE-2024-51251draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function.EPSS0.72%HighCVE-2024-51245draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function.EPSS0.81%CriticalCVE-2024-51138draytek · vigor1000b_firmware +22 moredraytek vigor1000b_firmwareVigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges.EPSS1.05%HighCVE-2024-51248draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function.EPSS0.81%HighCVE-2024-51249draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function.EPSS0.69%CriticalCVE-2024-51252draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.EPSS0.81%CriticalCVE-2024-51298draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.EPSS0.62%HighCVE-2024-51258draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.EPSS0.56%HighCVE-2024-51304draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function.EPSS0.61%CriticalCVE-2024-51260draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.EPSS0.62%HighCVE-2024-51296draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.EPSS0.61%HighCVE-2024-51301draytek · vigor3900_firmwaredraytek vigor3900_firmwareIn Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.EPSS0.61%CriticalCVE-2024-48153draytek · vigor3900_firmwaredraytek vigor3900_firmwareDrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.EPSS0.68%HighCVE-2024-48074draytek · vigor2960draytek vigor2960An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function.EPSS0.67%