Vulnerability Details CVE-2020-10826
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.615
EPSS Ranking 98.2%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- https://slashd.ga/2020/03/draytek-vulnerabilities/
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/
- https://slashd.ga/2020/03/draytek-vulnerabilities/
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/
Products affected by CVE-2020-10826
-
cpe:2.3:h:draytek:vigor2960:-
-
cpe:2.3:h:draytek:vigor300b:-
-
cpe:2.3:h:draytek:vigor3900:-
-
cpe:2.3:o:draytek:vigor2960_firmware:-
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.6
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.6.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.6.2
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.7
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.7.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.8
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.8.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.8.2
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.9
-
cpe:2.3:o:draytek:vigor2960_firmware:1.0.9.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.1.0
-
cpe:2.3:o:draytek:vigor2960_firmware:1.1.0.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.1.0.2
-
cpe:2.3:o:draytek:vigor2960_firmware:1.2.0
-
cpe:2.3:o:draytek:vigor2960_firmware:1.2.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.2.2
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.0
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.2
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.2.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.3
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.3.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.3.2
-
cpe:2.3:o:draytek:vigor2960_firmware:1.4.0
-
cpe:2.3:o:draytek:vigor2960_firmware:1.4.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.4.2.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.4.3
-
cpe:2.3:o:draytek:vigor2960_firmware:1.4.4
-
cpe:2.3:o:draytek:vigor2960_firmware:1.5.0
-
cpe:2.3:o:draytek:vigor300b_firmware:-
-
cpe:2.3:o:draytek:vigor300b_firmware:1.0.7
-
cpe:2.3:o:draytek:vigor300b_firmware:1.0.8
-
cpe:2.3:o:draytek:vigor300b_firmware:1.0.8.2
-
cpe:2.3:o:draytek:vigor300b_firmware:1.0.9
-
cpe:2.3:o:draytek:vigor300b_firmware:1.0.9.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.1.0
-
cpe:2.3:o:draytek:vigor300b_firmware:1.1.0.2
-
cpe:2.3:o:draytek:vigor300b_firmware:1.2.0
-
cpe:2.3:o:draytek:vigor300b_firmware:1.2.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.2.2
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.0
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.2
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.3
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.3.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.3.2
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.0
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.2.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.3
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.4
-
cpe:2.3:o:draytek:vigor3900_firmware:-
-
cpe:2.3:o:draytek:vigor3900_firmware:1.4.4