AVM develops a focused line of residential and small-business networking devices, principally the FRITZ!Box router family and FRITZ!OS firmware platform, which occupy a prominent place in consumer broadband deployments across Europe. The vendor's disclosure history clusters around web-interface and firmware-level input-handling weaknesses—including cross-site scripting, OS command injection, code injection, and information exposure—coupled with a notable tendency toward public exploit availability. Defenders should treat exposed FRITZ!Box management interfaces as a priority for network segmentation and access restriction; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Avm over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-9727HIGH AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm. | May 29, 2015 | 10.0 | 84 | NO | YES |
CVE-2020-26887HIGH FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism. | Oct 23, 2020 | 7.8 | 36 | NO | YES |
CVE-2000-0262MEDIUM The AVM KEN! ISDN Proxy server allows remote attackers to cause a denial of service via a malformed request. | Apr 12, 2000 | 5.0 | 25 | NO | YES |
CVE-2014-8886HIGH AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite cri | Jan 8, 2016 | 8.1 | 22 | NO | NO |
CVE-2014-8872HIGH Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50. | Aug 29, 2017 | 7.8 | 20 | NO | NO |
CVE-2007-0431HIGH AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP application crash) via a zero-length UDP packet to the SIP port (p | Jan 23, 2007 | 7.8 | 20 | NO | NO |
CVE-2015-7242MEDIUM Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the displa | Jan 12, 2016 | 6.1 | 17 | NO | NO |
Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate attackers to view slices of previously t | Oct 22, 2019 | 2.4 | 15 | NO | NO |
CVE-2000-0261MEDIUM The AVM KEN! web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Apr 12, 2000 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Avm.
Media articles that mention a CVE ID that affects a product developed by Avm — matched by CVE ID, not by vendor name.