CVE-2024-51139

< 4.4.5.5

Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.

9.8CRITICAL

CVE-2024-51138

< 4.4.5.5

Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and

9.8CRITICAL

CVE-2024-41340

< 4.4.5.1

An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7,

8.4HIGH

CVE-2024-41339

< 4.4.5.1

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 pr

8.8HIGH

CVE-2024-41338

< 4.4.5.1

A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925

7.5HIGH

CVE-2024-41334

< 4.4.5.1

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2

8.8HIGH

CVE-2024-41596

< 4.4.5.3

Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper

8.0HIGH

CVE-2024-41594

< 4.4.5.3

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server o

7.5HIGH

CVE-2024-41593

< 4.4.5.3

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), beca

9.8CRITICAL

CVE-2024-41592

< 4.4.5.3

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI misha

8.0HIGH

CVE-2024-41591

< 4.4.5.3

DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.

6.1MEDIUM

CVE-2024-41590

< 4.4.5.3

Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters

8.0HIGH

CVE-2024-41588

< 4.4.5.3

The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by aut

8.0HIGH

CVE-2024-41587

< 4.4.5.3

Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices

5.4MEDIUM

CVE-2023-23313

< 4.4.2.1

Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the r

6.1MEDIUM

CVE-2022-32548

< 4.4.2

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cg

10.0CRITICAL