CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-6265 – DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
https://notcve.org/view.php?id=CVE-2023-6265
Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported. Draytek Vigor2960 v1.5.1.4 y v1.5.1.5 son vulnerables a directory traversal a través del parámetro 'option' mainfunction.cgi dumpSyslog que permite a un atacante autenticado con acceso a la interfaz de administración web eliminar archivos arbitrarios. Vigor2960 ya no es compatible. • https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960 https://www.draytek.com/products/vigor2960 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-24229
https://notcve.org/view.php?id=CVE-2023-24229
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • https://github.com/sadwwcxz/Vul https://web.archive.org/web/20230315181013/https://github.com/sadwwcxz/Vul https://www.draytek.co.uk/support/guides/kb-remotemanagement https://www.draytek.com https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960 https://www.draytek.com/support/knowledge-base/5465 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-1009 – DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal
https://notcve.org/view.php?id=CVE-2023-1009
A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. • https://github.com/xxy1126/Vuln/blob/main/Draytek/1.md https://vuldb.com/?ctiid.221742 https://vuldb.com/?id.221742 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2021-43118
https://notcve.org/view.php?id=CVE-2021-43118
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code. Se presenta una vulnerabilidad de Inyección de Comando Remoto en DrayTek Vigor 2960 versión 1.5.1.3, DrayTek Vigor 3900 versión 1.5.1.3, y DrayTek Vigor 300B versión 1.5.1.3, por medio de un mensaje HTTP diseñado que contiene una cadena de consulta malformada en el archivo mainfunction.cgi, que podría permitir a un usuario remoto malicioso ejecutar código arbitrario • https://gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2021-42911
https://notcve.org/view.php?id=CVE-2021-42911
A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code. Se presenta una vulnerabilidad de cadena de formato en DrayTek Vigor 2960 versiones anteriores a 1.5.1.3 incluyéndola, DrayTek Vigor 3900 versiones anteriores a 1.5.1.3 incluyéndola, y DrayTek Vigor 300B versiones anteriores a 1.5.1.3 incluyéndola, en el archivo mainfunction.cgi por medio de un mensaje HTTP diseñado que contiene una cadena de consulta malformada, lo que podría permitir a un usuario remoto malicioso ejecutar código arbitrario • https://gist.github.com/Cossack9989/e9c1c2d2e69b773ca4251acdd77f2835 • CWE-134: Use of Externally-Controlled Format String •