vigor3910 firmware vulnerabilities and fixes

Recent CVEs affecting vigor3910 firmware, with upgrade or downgrade steps. 45 tracked.

Also searched as: vigor3910firmware.

vigor3910 firmware has 45 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 9. Most recent: 2024-10-03. Highest priority: CVE-2024-41593 (score 54/100).

• CVE-2024-46598 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin
• CVE-2024-46597 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi
• CVE-2024-46596 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi
• CVE-2024-46595 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.c
• CVE-2024-46594 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x
• CVE-2024-46593 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cg
• CVE-2024-46592 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v
• CVE-2024-46591 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi
• CVE-2024-46590 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x0
• CVE-2024-46589 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at ine
• CVE-2024-46588 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw
• CVE-2024-46586 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.c
• CVE-2024-46585 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at userg
• CVE-2024-46584 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontr
• CVE-2024-46583 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.
• CVE-2024-46582 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi
• CVE-2024-46581 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cg
• CVE-2024-46580 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi
• CVE-2024-46571 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.c
• CVE-2024-46568 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi
• CVE-2024-46567 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.
• CVE-2024-46566 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cg
• CVE-2024-46565 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.c
• CVE-2024-46564 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fexto
• CVE-2024-46561 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi
• CVE-2024-46560 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi
• CVE-2024-46559 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15
• CVE-2024-46558 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.c
• CVE-2024-46557 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00
• CVE-2024-46556 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00
• CVE-2024-46555 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi
• CVE-2024-46554 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi
• CVE-2024-46553 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.
• CVE-2024-46552 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstr
• CVE-2024-46551 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cg
• CVE-2024-46550 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chg
• CVE-2024-41595 HIGH 8.0 UPGRADE DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of servi
• CVE-2024-41593 CRITICAL 9.8 UPGRADE UPGRADE DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft
• CVE-2024-41589 HIGH 8.8 UPGRADE DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
• CVE-2024-41587 MEDIUM 5.4 UPGRADE UPGRADE Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayT
• CVE-2024-41586 HIGH 8.0 UPGRADE A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attack
• CVE-2024-41585 MEDIUM 6.8 UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an
• CVE-2024-41584 MEDIUM 4.7 UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by mi
• CVE-2024-41583 MEDIUM 4.7 UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated
• CVE-2024-23721 HIGH 7.5 UPGRADE A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices

FAQ

How do I fix vigor3910 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is vigor3910 firmware being exploited right now?

None of the tracked vigor3910 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which vigor3910 firmware CVE should I patch first?

CVE-2024-41593 currently ranks highest (54/100): DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft.

RSS feed for vigor3910 firmware · ← Back to latest CVEs