https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-51138.htmlhttps://patchthecve.com/cve/CVE-2024-51138.htmlSun, 05 Jul 2026 01:21:01 +0000CRITICAL 9.8: Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912https://patchthecve.com/cve/CVE-2024-41593.htmlhttps://patchthecve.com/cve/CVE-2024-41593.htmlWed, 17 Jun 2026 07:47:53 +0000CRITICAL 9.8: DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.https://patchthecve.com/cve/CVE-2024-41590.htmlhttps://patchthecve.com/cve/CVE-2024-41590.htmlWed, 17 Jun 2026 07:47:52 +0000HIGH 8.0: Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.https://patchthecve.com/cve/CVE-2024-41587.htmlhttps://patchthecve.com/cve/CVE-2024-41587.htmlWed, 17 Jun 2026 07:47:52 +0000MEDIUM 5.4: Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.