PatchTheCVE: vigor165 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-41340: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29https://patchthecve.com/cve/CVE-2024-41340.htmlhttps://patchthecve.com/cve/CVE-2024-41340.htmlSun, 05 Jul 2026 01:20:16 +0000HIGH 8.4: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 pCVE-2024-41339: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , https://patchthecve.com/cve/CVE-2024-41339.htmlhttps://patchthecve.com/cve/CVE-2024-41339.htmlSun, 05 Jul 2026 01:20:15 +0000HIGH 8.8: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2CVE-2024-41338: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.https://patchthecve.com/cve/CVE-2024-41338.htmlhttps://patchthecve.com/cve/CVE-2024-41338.htmlSun, 05 Jul 2026 01:20:15 +0000HIGH 7.5: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3,CVE-2024-41593: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function fthttps://patchthecve.com/cve/CVE-2024-41593.htmlhttps://patchthecve.com/cve/CVE-2024-41593.htmlWed, 17 Jun 2026 07:47:53 +0000CRITICAL 9.8: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.CVE-2024-41587: Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayThttps://patchthecve.com/cve/CVE-2024-41587.htmlhttps://patchthecve.com/cve/CVE-2024-41587.htmlWed, 17 Jun 2026 07:47:52 +0000MEDIUM 5.4: Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.