DrayTek

Security incidents tagged DrayTek. Newest first.

0 DrayTek incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 3 older incidents

May 15MediumDrayTek Vigor Routers: Vigor Routers OS Command Injection VulnerabilityPatched
DrayTek Vigor Routers Patched
DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface. Added to CISA KEV on 2025-05-15.
Open incident →CVE-2024-12987

Sep 30CriticalDrayTek Multiple Vigor Routers OS Command InjectionPatched
DrayTek Multiple Vigor Routers Patched
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Added to the CISA KEV catalog on 2024-09-30. CVE-2020-15415 was assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2020-15415
Sep 3HighDrayTek VigorConnect: 2 actively exploited vulnerabilitiesPatched
DrayTek VigorConnect Patched
CVE-2021-20123: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CVE-2021-20124: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to the CISA KEV catalog on 2024-09-03. CVE-2021-20123, CVE-2021-20124 were assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2021-20123 · CVE-2021-20124