PatchTheCVE: vigor2620 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-51139: Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier andhttps://patchthecve.com/cve/CVE-2024-51139.htmlhttps://patchthecve.com/cve/CVE-2024-51139.htmlSun, 05 Jul 2026 01:21:02 +0000CRITICAL 9.8: Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 aCVE-2024-51138: Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2https://patchthecve.com/cve/CVE-2024-51138.htmlhttps://patchthecve.com/cve/CVE-2024-51138.htmlSun, 05 Jul 2026 01:21:01 +0000CRITICAL 9.8: Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912CVE-2024-41340: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29https://patchthecve.com/cve/CVE-2024-41340.htmlhttps://patchthecve.com/cve/CVE-2024-41340.htmlSun, 05 Jul 2026 01:20:16 +0000HIGH 8.4: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 pCVE-2024-41339: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , https://patchthecve.com/cve/CVE-2024-41339.htmlhttps://patchthecve.com/cve/CVE-2024-41339.htmlSun, 05 Jul 2026 01:20:15 +0000HIGH 8.8: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2CVE-2024-41338: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.https://patchthecve.com/cve/CVE-2024-41338.htmlhttps://patchthecve.com/cve/CVE-2024-41338.htmlSun, 05 Jul 2026 01:20:15 +0000HIGH 7.5: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3,CVE-2024-41334: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to https://patchthecve.com/cve/CVE-2024-41334.htmlhttps://patchthecve.com/cve/CVE-2024-41334.htmlSun, 05 Jul 2026 01:20:13 +0000HIGH 8.8: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3CVE-2024-41596: Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI)https://patchthecve.com/cve/CVE-2024-41596.htmlhttps://patchthecve.com/cve/CVE-2024-41596.htmlWed, 17 Jun 2026 07:47:54 +0000HIGH 8.0: Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters.CVE-2024-41594: An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information becaushttps://patchthecve.com/cve/CVE-2024-41594.htmlhttps://patchthecve.com/cve/CVE-2024-41594.htmlWed, 17 Jun 2026 07:47:53 +0000HIGH 7.5: An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.CVE-2024-41592: DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters https://patchthecve.com/cve/CVE-2024-41592.htmlhttps://patchthecve.com/cve/CVE-2024-41592.htmlWed, 17 Jun 2026 07:47:53 +0000HIGH 8.0: DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.CVE-2024-41591: DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.https://patchthecve.com/cve/CVE-2024-41591.htmlhttps://patchthecve.com/cve/CVE-2024-41591.htmlWed, 17 Jun 2026 07:47:53 +0000MEDIUM 6.1: DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.CVE-2024-41588: The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffhttps://patchthecve.com/cve/CVE-2024-41588.htmlhttps://patchthecve.com/cve/CVE-2024-41588.htmlWed, 17 Jun 2026 07:47:52 +0000HIGH 8.0: The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function.