CVE-2021-42911: DrayTek VIGOR2960 Firmware

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code.

Affected products

• DrayTek VIGOR2960 Firmware: up to and including 1.5.1.3
• DrayTek VIGOR300B Firmware: up to and including 1.5.1.3
• DrayTek VIGOR3900 Firmware: up to and including 1.5.1.3

Published 2022-03-29. Last modified 2026-06-17.