{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:29:54.052Z",
  "tag": {
    "id": "draytek",
    "label": "DrayTek",
    "isStack": false,
    "url": "https://pwn.watch/t/draytek",
    "feed": "https://pwn.watch/t/draytek/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "draytek-vigor-routers-cve-2024-12987",
      "title": "DrayTek Vigor Routers: Vigor Routers OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987",
      "json": "https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "DrayTek Vigor Routers",
      "tags": [
        "draytek",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-12987"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-05-15",
      "closedAt": "2025-05-15",
      "updatedAt": "2025-05-15",
      "summary": "DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface. Added to CISA KEV on 2025-05-15.",
      "xPost": null
    },
    {
      "slug": "draytek-multiple-vigor-routers-cve-2020-15415",
      "title": "DrayTek Multiple Vigor Routers OS Command Injection",
      "url": "https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415",
      "json": "https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "DrayTek Multiple Vigor Routers",
      "tags": [
        "draytek",
        "router",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2020-15415"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-30",
      "closedAt": "2024-09-30",
      "updatedAt": "2024-09-30",
      "summary": "DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Added to the CISA KEV catalog on 2024-09-30. CVE-2020-15415 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "draytek-vigorconnect-cve-2021-20123-20124",
      "title": "DrayTek VigorConnect: 2 actively exploited vulnerabilities",
      "url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124",
      "json": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "DrayTek VigorConnect",
      "tags": [
        "draytek",
        "router",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2021-20123",
        "CVE-2021-20124"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-03",
      "closedAt": "2024-09-03",
      "updatedAt": "2024-09-03",
      "summary": "CVE-2021-20123: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CVE-2021-20124: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to the CISA KEV catalog on 2024-09-03. CVE-2021-20123, CVE-2021-20124 were assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "draytek-vigor-routers-cve-2024-12987",
      "incidentTitle": "DrayTek Vigor Routers: Vigor Routers OS Command Injection Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-15",
      "title": "CISA added CVE-2024-12987 to the KEV catalog (due 2025-06-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987"
    },
    {
      "incident": "draytek-multiple-vigor-routers-cve-2020-15415",
      "incidentTitle": "DrayTek Multiple Vigor Routers OS Command Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-30",
      "title": "CISA added CVE-2020-15415 to the KEV catalog (federal deadline 2024-10-21)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415"
    },
    {
      "incident": "draytek-vigorconnect-cve-2021-20123-20124",
      "incidentTitle": "DrayTek VigorConnect: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-03",
      "title": "CISA added CVE-2021-20123 to the KEV catalog (federal deadline 2024-09-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124"
    },
    {
      "incident": "draytek-vigorconnect-cve-2021-20123-20124",
      "incidentTitle": "DrayTek VigorConnect: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-03",
      "title": "CISA added CVE-2021-20124 to the KEV catalog (federal deadline 2024-09-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124"
    }
  ]
}