← Back

Vigor3900 Firmware

vigor3900_firmware

Vendor: Draytek • 48 CVEs

CVEs (48)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-14993
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
Nov 21, 2024
Jun 23, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to main...Show more
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.Show less
CVE-2020-10828
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
May 5, 2025
Mar 26, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
CVE-2020-10827
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
May 5, 2025
Mar 26, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
CVE-2020-10826
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
May 5, 2025
Mar 26, 2020
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.
CVE-2020-10825
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
May 5, 2025
Mar 26, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a re...Show more
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).Show less
CVE-2020-10824
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
May 5, 2025
Mar 26, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP requ...Show more
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).Show less
CVE-2020-10823
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
May 5, 2025
Mar 26, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request...Show more
A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).Show less
CVE-2020-8515
1Draytek
3Vigor2960 Firmware
Vigor300b FirmwareVigor3900 Firmware
Nov 7, 2025
Feb 1, 2020
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/main...Show more
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.Show less