Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 186

Export CSV
CVE-2026-113394

DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal

A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113390

DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113389

DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113391

DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 2.1% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113392

DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal

A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113393

DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload

A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113395

DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113396

DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113397

DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-71936

DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71931

DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 1.8% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71941

DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71926

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71921

DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.

CVSS 4.0 · 9.3 Critical EPSS 2.8% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71916

DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 1.8% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71911

DrayTek VigorAP Multiple Models Buffer Overflow via setLan

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 and 9 more
CVE-2026-71906

DrayTek VigorAP Multiple Models OS Command Injection via setLan

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 and 9 more
CVE-2026-71943

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71938

DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71933

DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more