draytek vulnerabilities

Recent CVEs affecting draytek products. 95 tracked.

draytek has 95 tracked vulnerabilities, 9 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 24. Most recent: 2026-02-23. Highest priority: CVE-2024-12987 (score 89/100).

• CVE-2024-51139 CRITICAL 9.8 UPGRADE UPGRADE Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and
• CVE-2024-51138 CRITICAL 9.8 UPGRADE UPGRADE Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2
• CVE-2024-41340 HIGH 8.4 UPGRADE UPGRADE An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29
• CVE-2024-41339 HIGH 8.8 UPGRADE UPGRADE An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 ,
• CVE-2024-41338 HIGH 7.5 UPGRADE UPGRADE A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.
• CVE-2024-41334 HIGH 8.8 UPGRADE UPGRADE Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to
• CVE-2026-3040 MEDIUM 4.7 UPGRADE A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6
• CVE-2024-51304 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51301 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51300 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51299 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51298 CRITICAL 9.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51296 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51260 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51259 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51258 HIGH 8.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51257 HIGH 8.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51255 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51254 HIGH 8.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-51253 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51252 CRITICAL 9.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51251 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51249 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51248 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51247 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51246 HIGH 8.0 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51245 HIGH 8.8 MITIGATE In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-51244 HIGH 8.8 MITIGATE In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitr
• CVE-2024-48153 CRITICAL 9.8 MITIGATE DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbi
• CVE-2024-48074 HIGH 8.0 MITIGATE An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can pl
• CVE-2024-46598 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin
• CVE-2024-46597 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi
• CVE-2024-46596 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi
• CVE-2024-46595 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.c
• CVE-2024-46594 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x
• CVE-2024-46593 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cg
• CVE-2024-46592 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v
• CVE-2024-46591 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi
• CVE-2024-46590 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x0
• CVE-2024-46589 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at ine
• CVE-2024-46588 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw
• CVE-2024-46586 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.c
• CVE-2024-46585 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at userg
• CVE-2024-46584 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontr
• CVE-2024-46583 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.
• CVE-2024-46582 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi
• CVE-2024-46581 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cg
• CVE-2024-46580 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi
• CVE-2024-46571 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.c
• CVE-2024-46568 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi
• CVE-2024-46567 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.
• CVE-2024-46566 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cg
• CVE-2024-46565 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.c
• CVE-2024-46564 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fexto
• CVE-2024-46561 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi
• CVE-2024-46560 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi
• CVE-2024-46559 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15
• CVE-2024-46558 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.c
• CVE-2024-46557 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00
• CVE-2024-46556 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00
• CVE-2024-46555 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi
• CVE-2024-46554 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi
• CVE-2024-46553 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.
• CVE-2024-46552 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstr
• CVE-2024-46551 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cg
• CVE-2024-46550 HIGH 7.5 MITIGATE Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chg
• CVE-2024-46316 HIGH 8.0 MITIGATE DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 funct
• CVE-2024-45893 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45891 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45890 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability oc
• CVE-2024-45889 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45888 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability
• CVE-2024-45887 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45885 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45884 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability
• CVE-2024-45882 HIGH 8.0 MITIGATE DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability
• CVE-2024-44845 HIGH 8.8 MITIGATE DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the
• CVE-2024-44844 HIGH 8.8 MITIGATE DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the
• CVE-2024-43027 HIGH 8.0 UPGRADE UPGRADE DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before
• CVE-2024-41596 HIGH 8.0 MITIGATE UPGRADE Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI)
• CVE-2024-41595 HIGH 8.0 UPGRADE DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of servi
• CVE-2024-41594 HIGH 7.5 MITIGATE UPGRADE An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information becaus
• CVE-2024-41593 CRITICAL 9.8 UPGRADE UPGRADE DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft
• CVE-2024-41592 HIGH 8.0 UPGRADE UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters
• CVE-2024-41591 MEDIUM 6.1 MITIGATE UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
• CVE-2024-41590 HIGH 8.0 UPGRADE UPGRADE Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds ch
• CVE-2024-41589 HIGH 8.8 UPGRADE DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
• CVE-2024-41588 HIGH 8.0 MITIGATE UPGRADE The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buff
• CVE-2024-41587 MEDIUM 5.4 UPGRADE UPGRADE Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayT
• CVE-2024-41586 HIGH 8.0 UPGRADE A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attack
• CVE-2024-41585 MEDIUM 6.8 UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an
• CVE-2024-41584 MEDIUM 4.7 UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by mi
• CVE-2024-41583 MEDIUM 4.7 UPGRADE DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated
• CVE-2024-12987 HIGH 7.3 EXPLOITED MITIGATE MITIGATE DrayTek Vigor Routers OS Command Injection Vulnerability
• CVE-2024-12986 HIGH 7.3 UPGRADE UPGRADE A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1

FAQ

How do I fix draytek vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is draytek being exploited right now?

Yes: 1 draytek CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which draytek CVE should I patch first?

CVE-2024-12987 currently ranks highest (89/100): DrayTek Vigor Routers OS Command Injection Vulnerability.

Products

• vigor1000b firmware
• vigor165 firmware
• vigor166 firmware
• vigor2135 firmware
• vigor2620 firmware
• vigor2763 firmware
• vigor2765 firmware
• vigor2766 firmware
• vigor2860 firmware
• vigor2862 firmware
• vigor2865 firmware
• vigor2866 firmware
• vigor2915 firmware
• vigor2925 firmware
• vigor2926 firmware
• vigor2952 firmware
• vigor2960 firmware
• vigor2962 firmware
• vigor300b firmware
• vigor3900 firmware
• vigor3910 firmware
• vigor3912 firmware
• vigorlte200 firmware

RSS feed for draytek · ← Back to latest CVEs