📦 Vigor2865 Firmware

by Draytek

🔍 What is Vigor2865 Firmware?

Description coming soon...

🛡️ Security Overview

Click on a severity to filter vulnerabilities

⚠️ Known Vulnerabilities

CVE-2024-51138

CRITICAL CVSS 9.8 Feb 27, 2025

A critical stack-based buffer overflow vulnerability in DrayTek router TR069 STUN server URL parsing allows remote attackers to execute arbitrary code with elevated privileges. This affects multiple D...

CVE-2024-41593

CRITICAL CVSS 9.8 Oct 3, 2024

CVE-2024-41593 is a critical heap-based buffer overflow vulnerability in DrayTek Vigor310 devices that allows remote attackers to execute arbitrary code. The vulnerability occurs due to sign-extension...

CVE-2024-41338

HIGH CVSS 7.5 Feb 27, 2025

A NULL pointer dereference vulnerability in multiple Draytek router models allows attackers to cause Denial of Service (DoS) via specially crafted DHCP requests. This affects organizations and individ...

CVE-2024-41339

HIGH CVSS 8.8 Feb 27, 2025

This vulnerability allows attackers to upload malicious kernel modules through the CGI configuration upload endpoint in affected Draytek routers, leading to arbitrary code execution with root privileg...

CVE-2024-41340

HIGH CVSS 8.4 Feb 27, 2025

This vulnerability in Draytek routers allows attackers to upload malicious APP Enforcement modules, leading to arbitrary code execution with root privileges. It affects multiple Draytek Vigor router m...

CVE-2024-41588

HIGH CVSS 8.0 Oct 3, 2024

This vulnerability allows authenticated users to exploit buffer overflows in DrayTek Vigor3910 devices by sending specially crafted POST requests to vulnerable CGI endpoints. Attackers could potential...

CVE-2024-41590

HIGH CVSS 8.0 Oct 3, 2024

This vulnerability allows authenticated users to exploit buffer overflows in CGI endpoints on DrayTek Vigor310 devices by sending specially crafted POST requests. Attackers could potentially execute a...

CVE-2024-41592

HIGH CVSS 8.0 Oct 3, 2024

DrayTek Vigor3910 devices have a stack-based buffer overflow vulnerability in the GetCGI function that processes query string parameters. Attackers can exploit this by sending specially crafted HTTP r...