DrayTek

Vulnerability activity for DrayTek: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 9
Critical (CVSS 9+): 3
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 9
Critical (CVSS 9+): 3
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 10
Critical (CVSS 9+): 3
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

7.3HighDec 27, 2024DrayTek Vigor Routers Code / command injectionCVE-2024-12987DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.Added to KEV May 15, 2025 · 138 days after publicationExploited98% likelyExploit codeNucleiDetection
9.8CriticalJun 30, 2020DrayTek Multiple Vigor Routers Code / command injectionCVE-2020-15415DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.Added to KEV Sep 30, 2024 · 1,552 days after publicationExploited84% likelyExploit codeNucleiDetection
7.5HighOct 13, 2021DrayTek VigorConnect Path traversal / file handlingCVE-2021-20123Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to KEV Sep 3, 2024 · 1,055 days after publicationExploited90% likelyExploit codeNucleiDetection
7.5HighOct 13, 2021DrayTek VigorConnect Path traversal / file handlingCVE-2021-20124Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.Added to KEV Sep 3, 2024 · 1,055 days after publicationExploited96% likelyExploit codeNucleiDetection
9.8CriticalFeb 1, 2020DrayTek Multiple Vigor Routers Code / command injectionCVE-2020-8515DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.Added to KEV Nov 3, 2021 · 640 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection

Recent

7.4HighOct 20, 2026DrayTek Vigor2960 Code / command injectionCVE-2026-113397A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.1% likely
7.4HighOct 20, 2026DrayTek Vigor2960 Code / command injectionCVE-2026-113396A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected comp1.6% likely
7.4HighOct 20, 2026DrayTek Vigor2960 Path traversal / file handlingCVE-2026-113395A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The ven
7.4HighOct 20, 2026DrayTek Vigor2960 Path traversal / file handlingCVE-2026-113394A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)".
6.3MediumOct 20, 2026DrayTek Vigor2960 Auth bypass / access controlCVE-2026-113393A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected compone
7.4HighOct 20, 2026DrayTek Vigor2960 Path traversal / file handlingCVE-2026-113392A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has c
9.9CriticalOct 20, 2026DrayTek Vigor2960 Code / command injectionCVE-2026-113390A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would1.9% likely
9.9CriticalOct 20, 2026DrayTek Vigor2960 Code / command injectionCVE-2026-113391A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed t2.1% likely
9.9CriticalOct 20, 2026DrayTek Vigor2960 Code / command injectionCVE-2026-113389A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.1.9% likely
4.7MediumFeb 23, 2026DrayTek Vigor 300B Code / command injectionCVE-2026-3040A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remot10% likely
7.3HighDec 27, 2024DrayTek Vigor Routers Code / command injectionCVE-2024-12987DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.Exploited98% likelyExploit codeNucleiDetection
9.8CriticalJun 30, 2020DrayTek Multiple Vigor Routers Code / command injectionCVE-2020-15415DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.Exploited84% likelyExploit codeNucleiDetection
7.5HighOct 13, 2021DrayTek VigorConnect Path traversal / file handlingCVE-2021-20124Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.Exploited96% likelyExploit codeNucleiDetection
7.5HighOct 13, 2021DrayTek VigorConnect Path traversal / file handlingCVE-2021-20123Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Exploited90% likelyExploit codeNucleiDetection
9.8CriticalFeb 1, 2020DrayTek Multiple Vigor Routers Code / command injectionCVE-2020-8515DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.Exploited100% likelyExploit codeExploit-DB · NucleiDetection

See every DrayTek entry on the dashboard.