Draytek Vigor3910 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Draytek Vigor3910 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (60)

• CVE-2022-32548 — CVSS 10.0 (critical): An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a…
• CVE-2024-41593 — CVSS 9.8 (critical): DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a…
• CVE-2024-51139 — CVSS 9.8 (critical): Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and…
• CVE-2024-51138 — CVSS 9.8 (critical): Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier…
• CVE-2023-33778 — CVSS 9.8 (critical): Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below…
• CVE-2024-41589 — CVSS 8.8 (high): DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
• CVE-2024-41339 — CVSS 8.8 (high): An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to…
• CVE-2024-41334 — CVSS 8.8 (high): Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior…
• CVE-2024-41340 — CVSS 8.4 (high): An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor…
• CVE-2024-41590 — CVSS 8.0 (high): Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed…
• CVE-2024-41596 — CVSS 8.0 (high): Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper…
• CVE-2024-41586 — CVSS 8.0 (high): A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code…
• CVE-2024-41595 — CVSS 8.0 (high): DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of…
• CVE-2024-41588 — CVSS 8.0 (high): The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by…
• CVE-2024-41592 — CVSS 8.0 (high): DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles…
• CVE-2024-46593 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows…
• CVE-2024-23721 — CVSS 7.5 (high): A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it…
• CVE-2024-41338 — CVSS 7.5 (high): A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to…
• CVE-2024-46592 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46594 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46595 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows…
• CVE-2024-46596 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46597 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows…
• CVE-2024-46598 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability…
• CVE-2024-41594 — CVSS 7.5 (high): An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the…
• CVE-2024-46550 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability…
• CVE-2024-46551 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows…
• CVE-2024-46552 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability…
• CVE-2024-46553 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46554 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46555 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46556 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46557 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46558 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46559 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability…
• CVE-2024-46560 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46561 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46564 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability…
• CVE-2024-46565 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows…
• CVE-2024-46566 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows…
• CVE-2024-46567 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46568 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows…
• CVE-2024-46571 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows…
• CVE-2024-46580 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46581 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46582 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46583 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability…
• CVE-2024-46584 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability…
• CVE-2024-46585 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability…
• CVE-2024-46586 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-46588 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability…
• CVE-2024-46589 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability…
• CVE-2024-46590 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability…
• CVE-2024-46591 — CVSS 7.5 (high): Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows…
• CVE-2024-41585 — CVSS 6.8 (medium): DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the…
• CVE-2024-41591 — CVSS 6.1 (medium): DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
• CVE-2023-23313 — CVSS 6.1 (medium): Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's…
• CVE-2024-41587 — CVSS 5.4 (medium): Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through…
• CVE-2024-41583 — CVSS 4.7 (medium): DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor…
• CVE-2024-41584 — CVSS 4.7 (medium): DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the…