vigor3900_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/vigor3900_firmware/ Sun, 26 Feb 2023 06:43:25 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png vigor3900_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/vigor3900_firmware/ 32 32 CVE-2020-8515 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8515/ Sun, 26 Feb 2023 06:43:25 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8515/ DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

The post CVE-2020-8515 appeared first on CVE Vulnerability.

]]> DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

The post CVE-2020-8515 appeared first on CVE Vulnerability.

]]> CVE-2020-15415 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15415/ Sun, 26 Feb 2023 06:37:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15415/ On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

The post CVE-2020-15415 appeared first on CVE Vulnerability.

]]> On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

The post CVE-2020-15415 appeared first on CVE Vulnerability.

]]> CVE-2020-14993 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-14993/ Sun, 26 Feb 2023 06:37:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-14993/ A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.

The post CVE-2020-14993 appeared first on CVE Vulnerability.

]]> A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.

The post CVE-2020-14993 appeared first on CVE Vulnerability.

]]> CVE-2020-14472 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-14472/ Sun, 26 Feb 2023 06:37:20 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-14472/ On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.

The post CVE-2020-14472 appeared first on CVE Vulnerability.

]]> On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.

The post CVE-2020-14472 appeared first on CVE Vulnerability.

]]> CVE-2020-14473 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-14473/ Sun, 26 Feb 2023 06:37:20 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-14473/ Stack-based buffer overflow vulnerability in Vigor3900, Vigor2960, and Vigor300B with firmware before 1.5.1.1.

The post CVE-2020-14473 appeared first on CVE Vulnerability.

]]> Stack-based buffer overflow vulnerability in Vigor3900, Vigor2960, and Vigor300B with firmware before 1.5.1.1.

The post CVE-2020-14473 appeared first on CVE Vulnerability.

]]> CVE-2020-10823 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10823/ Sun, 26 Feb 2023 06:35:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10823/ A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).

The post CVE-2020-10823 appeared first on CVE Vulnerability.

]]> A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).

The post CVE-2020-10823 appeared first on CVE Vulnerability.

]]> CVE-2020-10824 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10824/ Sun, 26 Feb 2023 06:35:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10824/ A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).

The post CVE-2020-10824 appeared first on CVE Vulnerability.

]]> A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).

The post CVE-2020-10824 appeared first on CVE Vulnerability.

]]> CVE-2020-10825 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10825/ Sun, 26 Feb 2023 06:35:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10825/ A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).

The post CVE-2020-10825 appeared first on CVE Vulnerability.

]]> A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).

The post CVE-2020-10825 appeared first on CVE Vulnerability.

]]> CVE-2020-10826 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10826/ Sun, 26 Feb 2023 06:35:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10826/ /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.

The post CVE-2020-10826 appeared first on CVE Vulnerability.

]]> /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.

The post CVE-2020-10826 appeared first on CVE Vulnerability.

]]> CVE-2020-10827 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10827/ Sun, 26 Feb 2023 06:35:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10827/ A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.

The post CVE-2020-10827 appeared first on CVE Vulnerability.

]]> A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.

The post CVE-2020-10827 appeared first on CVE Vulnerability.

]]>