DrayTek vulnerabilities
We track 148 vulnerabilities in DrayTek products across 60+ products. 148 are rated high or critical, and 5 have been exploited in real attacks. The most recent was published on October 20, 2026.
Latest DrayTek vulnerabilities
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function.
- 8.0 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi.
- 7.5 High severity
vigor3910_firmware: Improper Limitation of a Pathname to a Restricted Directory
A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information.
- 9.8 Critical severity
Vigor167 Firmware: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.
- 8.1 High severity
Vigor2960: Improper Limitation of a Pathname to a Restricted Directory
** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitr
- 9.8 Critical severity
vigor2620: Improper Control of Generation of Code
user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code segment, insert shellcode, and execute arbitrary code.
- 9.8 Critical severity
Myvigor: Use of Hard-coded Credentials
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers t
- 7.8 High severity
vigor2960_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longe
- 8.8 High severity
Vigor 2960: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the
- 9.8 Critical severity
Vigor3910 Firmware: Buffer Copy without Checking Size of Input
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
- 7.5 High severity
Draytek VigorConnect Path Traversal Exploited
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating
- 7.5 High severity
Draytek VigorConnect Path Traversal Exploited
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying o
- 9.8 Critical severity
DrayTek Multiple Vigor Routers OS Command Injection Exploited
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-202
- 9.8 Critical severity
Multiple DrayTek Vigor Routers Web Management Page Exploited
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fi