VF
Product
Vigor2620 Firmware
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 9Medium 2Low 0
Watch
Add Vigor2620 Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51139 | 9.8 | Feb 27 | Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and… Affected: before 3.9.9.1 |
| CVE-2024-51138 | 9.8 | Feb 27 | Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier;… Affected: before 3.9.9.1 |
| CVE-2024-41593 | 9.8 | Oct 3 | DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for… Affected: All versions, or not specified |
| CVE-2023-31447 | 9.8 | Aug 21 | user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code… Affected: before 3.9.8.4 |
| CVE-2024-41339 | 8.8 | Feb 27 | An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7,… Affected: before 3.9.8.9 |
| CVE-2024-41334 | 8.8 | Feb 27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior… Affected: before 3.9.8.8 |
| CVE-2024-41340 | 8.4 | Feb 27 | An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… Affected: before 3.9.8.9 |
| CVE-2024-41596 | 8.0 | Oct 3 | Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form… Affected: All versions, or not specified |
| CVE-2024-41592 | 8.0 | Oct 3 | DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long… Affected: before 3.9.8.9 |
| CVE-2024-41590 | 8.0 | Oct 3 | Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy… Affected: All versions, or not specified |
| CVE-2024-41588 | 8.0 | Oct 3 | The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds… Affected: All versions, or not specified |
| CVE-2024-41338 | 7.5 | Feb 27 | A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to… Affected: before 3.9.8.8 |
| CVE-2024-41594 | 7.5 | Oct 3 | An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string… Affected: All versions, or not specified |
| CVE-2024-41591 | 6.1 | Oct 3 | DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS Affected: All versions, or not specified |
| CVE-2024-41587 | 5.4 | Oct 3 | Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6 Affected: All versions, or not specified |
Showing 15