vigor3900 firmware vulnerabilities and fixes

Recent CVEs affecting vigor3900 firmware, with upgrade or downgrade steps. 35 tracked.

Also searched as: vigor3900firmware.

vigor3900 firmware has 35 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 1. Most recent: 2024-11-04. Highest priority: CVE-2024-51252 (score 59/100).

• CVE-2024-51304 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51301 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51300 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51299 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51298 CRITICAL 9.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51296 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51260 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51259 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51258 HIGH 8.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51257 HIGH 8.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51255 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51254 HIGH 8.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51253 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51252 CRITICAL 9.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51251 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51249 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51248 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51247 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51246 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51245 HIGH 8.8 MITIGATE In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51244 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-48153 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-46316 HIGH 8.0 MITIGATE DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 funct
• CVE-2024-45893 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45891 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45890 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability oc
• CVE-2024-45889 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45888 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability
• CVE-2024-45887 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45885 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45884 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45882 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability
• CVE-2024-44845 HIGH 8.8 MITIGATE DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the
• CVE-2024-44844 HIGH 8.8 MITIGATE DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the
• CVE-2024-43027 HIGH 8.0 UPGRADE UPGRADE DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before

FAQ

How do I fix vigor3900 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is vigor3900 firmware being exploited right now?

None of the tracked vigor3900 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which vigor3900 firmware CVE should I patch first?

CVE-2024-51252 currently ranks highest (59/100): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr.

RSS feed for vigor3900 firmware · ← Back to latest CVEs