Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (12 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-71910 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71904 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71912 1 Draytek 6 Vigorap 1060c Firmware, Vigorap 903 Firmware, Vigorap 906 Firmware and 3 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71907 1 Draytek 6 Vigorap 1060c Firmware, Vigorap 903 Firmware, Vigorap 906 Firmware and 3 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71905 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71906 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71908 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71911 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71914 1 Draytek 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more 2026-08-24 9.8 Critical
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger this vulnerability via a crafted message to execute arbitrary commands with root privileges.
CVE-2026-71913 1 Draytek 6 Vigorap 1060c Firmware, Vigorap 903 Firmware, Vigorap 906 Firmware and 3 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71909 1 Draytek 6 Vigorap 1060c Firmware, Vigorap 903 Firmware, Vigorap 906 Firmware and 3 more 2026-08-24 7.2 High
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2023-33778 1 Draytek 143 Myvigor, Vigor1000b, Vigor1000b Firmware and 140 more 2025-01-09 9.8 Critical
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.