DrayTek Corporation Vigor3900 Firmware vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting DrayTek Corporation Vigor3900 Firmware: 2 record(s), with affected versions and fixes.
cpe:2.3:o:draytek:vigor3900_firmware

CVE-2020-15415 Critical · 9.8 KEV High · 67 Public exploit CWE-78 Jun 30, 2020

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

CVE-2020-8515 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-78 Feb 1, 2020

Multiple DrayTek Vigor Routers Web Management Page Vulnerability

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.