Veille CVE

Recherche « DrayTek Vigor300B »

2 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « DrayTek Vigor300B » ✕
  1. CVE-2024-12987 9.8 Critique Exploitée

    DrayTek Vigor2960 · DrayTek Vigor300B · Draytek vigor300b firmware · Draytek vigor2960 firmware

    A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.

  2. CVE-2020-15415 9.8 Critique Exploitée

    draytek vigor3900_firmware · draytek vigor2960_firmware · draytek vigor300b_firmware · Draytek vigor3900 firmware

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.