DrayTek VIGOR2927 Firmware vulnerabilities

8 CVEs affecting DrayTek VIGOR2927 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-51139, published 2025-02-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-32548, published 2022-08-29. Critical severity, CVSS 9.8. EPSS: 34% chance of exploitation in the next 30 days. An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab…
CVE-2024-51138, published 2025-02-27. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766…
CVE-2024-51139, published 2025-02-27. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and…
CVE-2024-41339, published 2025-02-27. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926…
CVE-2024-41338, published 2025-02-27. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor…
CVE-2024-41334, published 2025-02-27. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor…
CVE-2023-23313, published 2023-03-03. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910,…
CVE-2024-41340, published 2025-02-27. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to…