Product:

Vigor3900_firmware

(Draytek)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 20
Date Id Summary Products Score Patch Annotated
2024-11-01 CVE-2024-51248 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function. Vigor3900_firmware 8.8
2024-11-01 CVE-2024-51252 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function. Vigor3900_firmware 9.8
2024-09-06 CVE-2024-44844 DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function. Vigor3900_firmware 8.8
2024-09-06 CVE-2024-44845 DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function. Vigor3900_firmware 8.8
2020-03-26 CVE-2020-10826 /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode. Vigor2960_firmware, Vigor300b_firmware, Vigor3900_firmware 9.8
2020-03-26 CVE-2020-10828 A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request. Vigor2960_firmware, Vigor300b_firmware, Vigor3900_firmware N/A
2020-03-26 CVE-2020-10827 A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request. Vigor2960_firmware, Vigor300b_firmware, Vigor3900_firmware N/A
2020-03-26 CVE-2020-10825 A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3). Vigor2960_firmware, Vigor300b_firmware, Vigor3900_firmware N/A
2020-03-26 CVE-2020-10824 A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3). Vigor2960_firmware, Vigor300b_firmware, Vigor3900_firmware N/A
2020-03-26 CVE-2020-10823 A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3). Vigor2960_firmware, Vigor300b_firmware, Vigor3900_firmware N/A