DrayTek vulnerabilities
We track 148 vulnerabilities in DrayTek products across 60+ products. 148 are rated high or critical, and 5 have been exploited in real attacks. The most recent was published on October 20, 2026.
Latest DrayTek vulnerabilities
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafte
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attack
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerabili
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can tr
- 7.2 High severity
VigorAP 918R: Improper Neutralization of Special Elements used in an OS Command
Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote
- 8.1 High severity
Vigor 2960: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword para
- 7.2 High severity
Vigor 300B: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command inje
- 9.8 Critical severity
Vigor2620 Firmware: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and e
- 9.8 Critical severity
Vigor3912 Firmware: Stack-based Buffer Overflow
Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier;
- 8.4 High severity
Vigor165 Firmware: Unrestricted Upload of File with Dangerous Type
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2
- 8.8 High severity
Vigor165 Firmware: Unrestricted Upload of File with Dangerous Type
An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2
- 7.5 High severity
Vigor165 Firmware: NULL Pointer Dereference
A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1,
- 8.8 High severity
Vigor166 Firmware: Improper Certificate Validation
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to
- 9.8 Critical severity
DrayTek Vigor Routers OS Command Injection Exploited
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argum
- 9.8 Critical severity
Vigor2960: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi/apmcfgupptim of the component Web Management Interface. The m
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `doOpenVPN.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `autodiscovery_clear.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.`
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function.
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function.
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function.
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function.
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.