PatchTheCVE: vigor166 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-41340: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29https://patchthecve.com/cve/CVE-2024-41340.htmlhttps://patchthecve.com/cve/CVE-2024-41340.htmlSun, 05 Jul 2026 01:20:16 +0000HIGH 8.4: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 pCVE-2024-41339: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , https://patchthecve.com/cve/CVE-2024-41339.htmlhttps://patchthecve.com/cve/CVE-2024-41339.htmlSun, 05 Jul 2026 01:20:15 +0000HIGH 8.8: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2CVE-2024-41338: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.https://patchthecve.com/cve/CVE-2024-41338.htmlhttps://patchthecve.com/cve/CVE-2024-41338.htmlSun, 05 Jul 2026 01:20:15 +0000HIGH 7.5: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3,CVE-2024-41334: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to https://patchthecve.com/cve/CVE-2024-41334.htmlhttps://patchthecve.com/cve/CVE-2024-41334.htmlSun, 05 Jul 2026 01:20:13 +0000HIGH 8.8: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3CVE-2024-41593: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function fthttps://patchthecve.com/cve/CVE-2024-41593.htmlhttps://patchthecve.com/cve/CVE-2024-41593.htmlWed, 17 Jun 2026 07:47:53 +0000CRITICAL 9.8: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.CVE-2024-41590: Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds chhttps://patchthecve.com/cve/CVE-2024-41590.htmlhttps://patchthecve.com/cve/CVE-2024-41590.htmlWed, 17 Jun 2026 07:47:52 +0000HIGH 8.0: Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.CVE-2024-41587: Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayThttps://patchthecve.com/cve/CVE-2024-41587.htmlhttps://patchthecve.com/cve/CVE-2024-41587.htmlWed, 17 Jun 2026 07:47:52 +0000MEDIUM 5.4: Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.