Filtered by vendor Draytek Subscriptions
Filtered by product Vigor2620 Firmware Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-31447 1 Draytek 4 Vigor2620, Vigor2620 Firmware, Vigor2625 and 1 more 2024-11-21 9.8 Critical
user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code segment, insert shellcode, and execute arbitrary code.
CVE-2024-41593 1 Draytek 48 Vigor1000b, Vigor1000b Firmware, Vigor165 and 45 more 2024-10-08 9.8 Critical
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.
CVE-2024-41591 1 Draytek 48 Vigor1000b, Vigor1000b Firmware, Vigor165 and 45 more 2024-10-08 6.1 Medium
DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
CVE-2024-41587 1 Draytek 48 Vigor1000b, Vigor1000b Firmware, Vigor165 and 45 more 2024-10-08 5.4 Medium
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.
CVE-2024-41594 1 Draytek 48 Vigor1000b, Vigor1000b Firmware, Vigor165 and 45 more 2024-10-08 7.5 High
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.