CVE-2020-28968: DrayTek Vigorap 1000c Firmware

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.

Affected products

• DrayTek Vigorap 1000c Firmware: version 1.3.2 only
• DrayTek Vigorap 700 Firmware: version 1.11 only
• DrayTek Vigorap 710 Firmware: version 1.2.5 only
• DrayTek Vigorap 800 Firmware: version 1.1.4 only
• DrayTek Vigorap 802 Firmware: version 1.3.2 only
• DrayTek Vigorap 810 Firmware: version 1.2.5 only
• DrayTek Vigorap 900 Firmware: version 1.2.0 only
• DrayTek Vigorap 902 Firmware: version 1.2.5 only
• DrayTek Vigorap 903 Firmware: version 1.3.1 only
• DrayTek Vigorap 910c Firmware: version 1.2.5 only
• DrayTek Vigorap 912c Firmware: version 1.3.2 only
• DrayTek Vigorap 918r Firmware: version 1.3.2 only
• DrayTek Vigorap 920r Firmware: version 1.3.0 only

Published 2021-10-22. Last modified 2026-06-17.