# cve.now: DrayTek

The newest entries naming DrayTek as an affected vendor (up to 200), of 59 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-113397](https://cve.now/CVE-2026-113397.md): DrayTek Vigor2960 IPsec mainfunction.cgi ruequest\_certificate command injection (CVSS 5.3)
- [CVE-2026-113396](https://cve.now/CVE-2026-113396.md): DrayTek Vigor2960 Rename Table mainfunction.cgi rename\_table command injection (CVSS 5.3)
- [CVE-2026-113395](https://cve.now/CVE-2026-113395.md): DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal (CVSS 5.3)
- [CVE-2026-113394](https://cve.now/CVE-2026-113394.md): DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal (CVSS 5.3)
- [CVE-2026-113393](https://cve.now/CVE-2026-113393.md): DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload (CVSS 5.3)
- [CVE-2026-113392](https://cve.now/CVE-2026-113392.md): DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal (CVSS 5.3)
- [CVE-2026-113391](https://cve.now/CVE-2026-113391.md): DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection (CVSS 9.4)
- [CVE-2026-113390](https://cve.now/CVE-2026-113390.md): DrayTek Vigor2960 CGI mainfunction.cgi sub\_182B0 os command injection (CVSS 9.4)
- [CVE-2026-113389](https://cve.now/CVE-2026-113389.md): DrayTek Vigor2960 CGI Process mainfunction.cgi set\_table command injection (CVSS 9.4)
- [CVE-2026-71943](https://cve.now/CVE-2026-71943.md): DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet (CVSS 8.6)
- [CVE-2026-71942](https://cve.now/CVE-2026-71942.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via mail\_mailalert (CVSS 8.6)
- [CVE-2026-71941](https://cve.now/CVE-2026-71941.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via diag\_logmail (CVSS 8.6)
- [CVE-2026-71940](https://cve.now/CVE-2026-71940.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via acl\_general\_setup Edit ACE (CVSS 8.6)
- [CVE-2026-71939](https://cve.now/CVE-2026-71939.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via acl\_general\_setup Add ACE (CVSS 8.6)
- [CVE-2026-71938](https://cve.now/CVE-2026-71938.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via switch\_lan\_gvrp (CVSS 8.6)
- [CVE-2026-71937](https://cve.now/CVE-2026-71937.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via poe\_schedule\_profile (CVSS 8.6)
- [CVE-2026-71936](https://cve.now/CVE-2026-71936.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot (CVSS 8.6)
- [CVE-2026-71935](https://cve.now/CVE-2026-71935.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction (CVSS 8.6)
- [CVE-2026-71934](https://cve.now/CVE-2026-71934.md): DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace (CVSS 8.6)
- [CVE-2026-71933](https://cve.now/CVE-2026-71933.md): DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions (CVSS 8.8)
- [CVE-2026-71932](https://cve.now/CVE-2026-71932.md): DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile (CVSS 6.9)
- [CVE-2026-71931](https://cve.now/CVE-2026-71931.md): DrayTek VigorSwitch Multiple Models OS Command Injection via tftp\_upgrade (CVSS 8.6)
- [CVE-2026-71930](https://cve.now/CVE-2026-71930.md): DrayTek VigorSwitch Multiple Models OS Command Injection via setTime (CVSS 8.6)
- [CVE-2026-71929](https://cve.now/CVE-2026-71929.md): DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto (CVSS 8.6)
- [CVE-2026-71928](https://cve.now/CVE-2026-71928.md): DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice (CVSS 8.6)
- [CVE-2026-71927](https://cve.now/CVE-2026-71927.md): DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice (CVSS 8.6)
- [CVE-2026-71926](https://cve.now/CVE-2026-71926.md): DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice (CVSS 8.6)
- [CVE-2026-71925](https://cve.now/CVE-2026-71925.md): DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail (CVSS 8.6)
- [CVE-2026-71924](https://cve.now/CVE-2026-71924.md): DrayTek VigorSwitch Multiple Models OS Command Injection via getVid (CVSS 8.6)
- [CVE-2026-71923](https://cve.now/CVE-2026-71923.md): DrayTek VigorSwitch Multiple Models OS Command Injection via auth\_set (CVSS 8.6)
- [CVE-2026-71922](https://cve.now/CVE-2026-71922.md): DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi (CVSS 8.7)
- [CVE-2026-71921](https://cve.now/CVE-2026-71921.md): DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi (CVSS 9.3)
- [CVE-2026-71920](https://cve.now/CVE-2026-71920.md): DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout (CVSS 6.9)
- [CVE-2026-71919](https://cve.now/CVE-2026-71919.md): DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot (CVSS 8.6)
- [CVE-2026-71918](https://cve.now/CVE-2026-71918.md): DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction (CVSS 8.6)
- [CVE-2026-71917](https://cve.now/CVE-2026-71917.md): DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace (CVSS 8.6)
- [CVE-2026-71916](https://cve.now/CVE-2026-71916.md): DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable (CVSS 8.6)
- [CVE-2026-71915](https://cve.now/CVE-2026-71915.md): DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus (CVSS 8.6)
- [CVE-2026-71914](https://cve.now/CVE-2026-71914.md): DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray\_apm (CVSS 9.3)
- [CVE-2026-71913](https://cve.now/CVE-2026-71913.md): DrayTek VigorAP Multiple Models OS Command Injection via upload\_settings.cgi (CVSS 8.6)
- [CVE-2026-71912](https://cve.now/CVE-2026-71912.md): DrayTek VigorAP Multiple Models Buffer Overflow via apautotest (CVSS 8.6)
- [CVE-2026-71911](https://cve.now/CVE-2026-71911.md): DrayTek VigorAP Multiple Models Buffer Overflow via setLan (CVSS 8.6)
- [CVE-2026-71910](https://cve.now/CVE-2026-71910.md): DrayTek VigorAP Multiple Models OS Command Injection via apautotest (CVSS 8.6)
- [CVE-2026-71909](https://cve.now/CVE-2026-71909.md): DrayTek VigorAP Multiple Models OS Command Injection via InquierTime (CVSS 8.6)
- [CVE-2026-71908](https://cve.now/CVE-2026-71908.md): DrayTek VigorAP Multiple Models OS Command Injection via mesh\_start\_speed\_test (CVSS 8.6)
- [CVE-2026-71907](https://cve.now/CVE-2026-71907.md): DrayTek VigorAP Multiple Models OS Command Injection via setcamset (CVSS 8.6)
- [CVE-2026-71906](https://cve.now/CVE-2026-71906.md): DrayTek VigorAP Multiple Models OS Command Injection via setLan (CVSS 8.6)
- [CVE-2026-71905](https://cve.now/CVE-2026-71905.md): DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings (CVSS 8.6)
- [CVE-2026-71904](https://cve.now/CVE-2026-71904.md): DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform (CVSS 8.6)
- [CVE-2022-50994](https://cve.now/CVE-2022-50994.md): DrayTek Vigor 2960 \< 1.5.1.4 OS Command Injection via mainfunction.cgi (CVSS 9.2)
- [CVE-2026-3040](https://cve.now/CVE-2026-3040.md): DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection (CVSS 5.1)
- [CVE-2025-10547](https://cve.now/CVE-2025-10547.md): CVE-2025-10547 (CVSS 9.8)
- [CVE-2024-12987](https://cve.now/CVE-2024-12987.md): DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection (CVSS 6.9, KEV)
- [CVE-2024-12986](https://cve.now/CVE-2024-12986.md): DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection (CVSS 6.9)
- [CVE-2023-6265](https://cve.now/CVE-2023-6265.md): DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal (CVSS 6.5)
- [CVE-2023-1163](https://cve.now/CVE-2023-1163.md): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal (CVSS 6.5)
- [CVE-2023-1162](https://cve.now/CVE-2023-1162.md): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection (CVSS 7.2)
- [CVE-2023-1009](https://cve.now/CVE-2023-1009.md): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub\_1DF14 path traversal (CVSS 6.5)
- [CVE-2020-3932](https://cve.now/CVE-2020-3932.md): Draytek VigorAP910C - Information Leakage (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/draytek
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.