Login Request a demo
DR
Vendor
Draytek
137 products with CVEs on record
676
CVEs
15
On KEV
9
New 30D
Products
VI
Vigor2960
DrayTek
9.9
30 CVEs3 on KEV9 new
VF
Vigor300b Firmware
Draytek
9.8
17 CVEs3 on KEV0 new
VF
Vigor3900 Firmware
Draytek
9.8
48 CVEs2 on KEV0 new
VI
VigorConnect
DrayTek
9.8
7 CVEs2 on KEV0 new
MV
Multiple Vigor Routers
DrayTek
9.8
2 CVEs2 on KEV0 new
VI
Vigor2960
DrayTek
9.8
2 CVEs1 on KEV0 new
VI
Vigor300B
DrayTek
9.8
2 CVEs1 on KEV0 new
VR
Vigor Routers
DrayTek
9.8
1 CVEs1 on KEV0 new
VF
Vigor3910 Firmware
Draytek
9.8
59 CVEs0 on KEV0 new
VF
Vigor2925 Firmware
Draytek
9.8
17 CVEs0 on KEV0 new
VF
Vigor2133 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2135 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2762 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2765 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2766 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2832 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2926 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2962 Firmware
Draytek
9.8
16 CVEs0 on KEV0 new
VF
Vigor2620 Firmware
Draytek
9.8
15 CVEs0 on KEV0 new
VF
Vigor2860 Firmware
Draytek
9.8
15 CVEs0 on KEV0 new
VF
Vigor2862 Firmware
Draytek
9.8
15 CVEs0 on KEV0 new
VF
Vigor2865 Firmware
Draytek
9.8
15 CVEs0 on KEV0 new
VF
Vigor165 Firmware
Draytek
9.8
14 CVEs0 on KEV0 new
VF
Vigor166 Firmware
Draytek
9.8
14 CVEs0 on KEV0 new
VF
Vigor2866 Firmware
Draytek
9.8
14 CVEs0 on KEV0 new
VF
Vigor3912 Firmware
Draytek
9.8
14 CVEs0 on KEV0 new
VF
Vigorlte200 Firmware
Draytek
9.8
14 CVEs0 on KEV0 new
VF
Vigor1000b Firmware
Draytek
9.8
12 CVEs0 on KEV0 new
VF
Vigor2952 Firmware
Draytek
9.8
12 CVEs0 on KEV0 new
VF
Vigor3220 Firmware
Draytek
9.8
12 CVEs0 on KEV0 new
VF
Vigor2763 Firmware
Draytek
9.8
11 CVEs0 on KEV0 new
VF
Vigor2915 Firmware
Draytek
9.8
11 CVEs0 on KEV0 new
VF
Vigor2927 Firmware
Draytek
9.8
8 CVEs0 on KEV0 new
V9
Vigorap 910c Firmware
Draytek
8.8
4 CVEs0 on KEV0 new
VF
Vigor2135ac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2135fvac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2135vac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2765ac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2766ac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2766vac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2927ac Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
VF
Vigor2927ax Firmware
Draytek
9.8
3 CVEs0 on KEV0 new
V2
Vigor 2960 Firmware
Draytek
8.8
2 CVEs0 on KEV0 new
VF
Vigor2133ac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2133fvac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2133n Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2133vac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2135ax Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2620l Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2620ln Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2762ac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2762n Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2762vac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2763ac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2765ax Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2765vac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2766ax Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2832n Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2862ac Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
VF
Vigor2862b Firmware
Draytek
9.8
2 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-113397
VI
Vigor2960
DrayTek
7.4
1%
Oct 20DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
CVE-2026-113396
VI
Vigor2960
DrayTek
7.4
2%
Oct 20DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
CVE-2026-113395
VI
Vigor2960
DrayTek
7.4
0%
Oct 20DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal
CVE-2026-113394
VI
Vigor2960
DrayTek
7.4
0%
Oct 20DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
CVE-2026-113393
VI
Vigor2960
DrayTek
6.3
0%
Oct 20DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
CVE-2026-113392
VI
Vigor2960
DrayTek
7.4
0%
Oct 20DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal
CVE-2026-113391
VI
Vigor2960
DrayTek
9.9
2%
Oct 20DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
CVE-2026-113390
VI
Vigor2960
DrayTek
9.9
2%
Oct 20DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
CVE-2026-113389
VI
Vigor2960
DrayTek
9.9
2%
Oct 20DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
CVE-2022-50994
V2
Vigor 2960
DrayTek
8.1
1%
May 8DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi
CVE-2026-3040
VF
Vigor300b Firmware
Draytek
7.2
10%
Feb 23A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6
CVE-2024-51139
VF
Vigor3910 Firmware
Draytek
9.8
1%
Feb 27Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and…
CVE-2024-51138
VF
Vigor2765 Firmware
Draytek
9.8
1%
Feb 27Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier;…
CVE-2024-41340
VF
Vigor2925 Firmware
Draytek
8.4
0%
Feb 27An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor…
CVE-2024-41339
VF
Vigor2925 Firmware
Draytek
8.8
1%
Feb 27An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7,…
CVE-2024-41338
VF
Vigor2866 Firmware
Draytek
7.5
0%
Feb 27A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to…
CVE-2024-41334
VF
Vigor2860 Firmware
Draytek
8.8
0%
Feb 27Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior…
CVE-2024-12987
In wildKEV
VI
Vigor300B
DrayTek
9.8
98%
Dec 27DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
CVE-2024-12986
VI
Vigor2960
DrayTek
9.8
35%
Dec 27DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection
CVE-2024-45893
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
CVE-2024-45891
VF
Vigor3900 Firmware
Draytek
8.0
1%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
CVE-2024-45890
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set…
CVE-2024-45889
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
CVE-2024-45888
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability
CVE-2024-45887
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
CVE-2024-45885
VF
Vigor3900 Firmware
Draytek
8.0
1%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
CVE-2024-45884
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
CVE-2024-45882
VF
Vigor3900 Firmware
Draytek
8.0
2%
Nov 4DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability
CVE-2024-51253
VF
Vigor3900 Firmware
Draytek
8.0
1%
Nov 4In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function
CVE-2024-51251
VF
Vigor3900 Firmware
Draytek
8.0
1%
Nov 4In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function
CVE-2024-51249
VF
Vigor3900 Firmware
Draytek
8.0
1%
Nov 4In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function
CVE-2024-51246
VF
Vigor3900 Firmware
Draytek
8.0
0%
Nov 4In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function
CVE-2024-51252
VF
Vigor3900 Firmware
Draytek
9.8
1%
Nov 1In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function
CVE-2024-51248
VF
Vigor3900 Firmware
Draytek
8.8
1%
Nov 1In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function
CVE-2024-51247
VF
Vigor3900 Firmware
Draytek
8.8
1%
Nov 1In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function
CVE-2024-51245
VF
Vigor3900 Firmware
Draytek
8.8
1%
Nov 1In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function
CVE-2024-51244
VF
Vigor3900 Firmware
Draytek
8.8
1%
Nov 1In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function
CVE-2024-51260
VF
Vigor3900 Firmware
Draytek
9.8
1%
Oct 31DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function
CVE-2024-51255
VF
Vigor3900 Firmware
Draytek
9.8
0%
Oct 31DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function
CVE-2024-51259
VF
Vigor3900 Firmware
Draytek
9.8
0%
Oct 31DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function
CVE-2024-51254
VF
Vigor3900 Firmware
Draytek
8.8
0%
Oct 31DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function
CVE-2024-51258
VF
Vigor3900 Firmware
Draytek
8.8
1%
Oct 30DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function
CVE-2024-51301
VF
Vigor3900 Firmware
Draytek
8.8
1%
Oct 30In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function
CVE-2024-51300
VF
Vigor3900 Firmware
Draytek
8.8
1%
Oct 30In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function
CVE-2024-51299
VF
Vigor3900 Firmware
Draytek
8.8
1%
Oct 30In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function
CVE-2024-51298
VF
Vigor3900 Firmware
Draytek
9.8
1%
Oct 30In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function
CVE-2024-51296
VF
Vigor3900 Firmware
Draytek
8.8
1%
Oct 30In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function
CVE-2024-51257
VF
Vigor3900 Firmware
Draytek
8.8
0%
Oct 30DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function
CVE-2024-51304
VF
Vigor3900 Firmware
Draytek
8.8
1%
Oct 30In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function
CVE-2024-48074
VF
Vigor2960 Firmware
Draytek
8.0
1%
Oct 28An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE…
CVE-2024-48153
VF
Vigor3900 Firmware
Draytek
9.8
1%
Oct 14DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function
CVE-2024-46316
VF
Vigor3900 Firmware
Draytek
8.0
1%
Oct 9DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 function at /cgi-bin/mainfunction.cgi
CVE-2024-41596
VF
Vigor2952 Firmware
Draytek
8.0
0%
Oct 3Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form…
CVE-2024-41595
VF
Vigor3910 Firmware
Draytek
8.0
0%
Oct 3DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds checks on read and write…
CVE-2024-41594
VF
Vigor165 Firmware
Draytek
7.5
0%
Oct 3An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string…
CVE-2024-41593
VF
Vigorlte200 Firmware
Draytek
9.8
1%
Oct 3DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for…
CVE-2024-41592
VF
Vigor2766 Firmware
Draytek
8.0
1%
Oct 3DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long…
CVE-2024-41591
VF
Vigor2135 Firmware
Draytek
6.1
0%
Oct 3DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS
CVE-2024-41590
VF
Vigor2952 Firmware
Draytek
8.0
0%
Oct 3Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy…
CVE-2024-41589
VF
Vigor3910 Firmware
Draytek
8.8
0%
Oct 3DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests