DrayTek vulnerabilities
We track 148 vulnerabilities in DrayTek products across 60+ products. 148 are rated high or critical, and 5 have been exploited in real attacks. The most recent was published on October 20, 2026.
Latest DrayTek vulnerabilities
- 7.4 High severity
Vigor2960: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to comman
- 7.4 High severity
Vigor2960: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command
- 7.4 High severity
Vigor2960: Improper Limitation of a Pathname to a Restricted Directory
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path tr
- 7.4 High severity
Vigor2960: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the atta
- 7.4 High severity
Vigor2960: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The atta
- 9.9 Critical severity
Vigor2960: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed re
- 9.9 Critical severity
Vigor2960: Improper Neutralization of Special Elements used in a Command
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os comman
- 9.9 Critical severity
Vigor2960: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in comman
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vuln
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size.
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via cra
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_d
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via craft
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total l
- 7.2 High severity
VigorSwitch G2540xs: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker c
- 9.1 Critical severity
VigorSwitch G2540xs: Missing Authorization
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify con
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulne
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulner
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vu
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vuln
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can tri
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vuln
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnera
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulne
- 7.5 High severity
VigorSwitch G2540xs: NULL Pointer Dereference
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerabili
- 9.8 Critical severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this v
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote atta
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via cra
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter fi
- 7.2 High severity
VigorSwitch G2540xs: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger
- 9.8 Critical severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger th
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigge
- 7.2 High severity
VigorAP 918R: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability vi
- 7.2 High severity
VigorAP 918R: Buffer Copy without Checking Size of Input
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can tri
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnera