Vigor166
Vendor:
First CVE: Aug 29, 2022 · Active for 3 years
15
Total CVEs
More Total CVEs than 92% of tracked products
3.8
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
8.0
Avg CVSS
Higher Avg CVSS than 69% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Vigor166 over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 29, 2022
3 years ago
Most Recent CVE
Feb 27, 2025
512 days ago
CVE Severity & Scoring
Vigor16615 CVEs
20%
60%
20%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (6.7%)
Network10 (66.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network4 (26.7%)
Attack Complexity
Low15 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None12 (80.0%)
Unknown0 (0.0%)
Required3 (20.0%)
Privileges Required
Low7 (46.7%)
High0 (0.0%)
None8 (53.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-32548CRITICAL An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or passwo | Aug 29, 2022 | 9.8 | 50 | NO | NO |
CVE-2024-41334HIGH Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior | Feb 27, 2025 | 8.8 | 29 | NO | NO |
CVE-2023-33778CRITICAL Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below | Jun 1, 2023 | 9.8 | 28 | NO | NO |
CVE-2024-41339HIGH An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, | Feb 27, 2025 | 8.8 | 27 | NO | NO |
CVE-2024-41593CRITICAL DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the | Oct 3, 2024 | 9.8 | 27 | NO | NO |
CVE-2024-41592HIGH DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key | Oct 3, 2024 | 8.0 | 27 | NO | NO |
CVE-2024-41340HIGH An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762 | Feb 27, 2025 | 8.4 | 26 | NO | NO |
CVE-2024-41338HIGH A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9. | Feb 27, 2025 | 7.5 | 24 | NO | NO |
CVE-2024-41596HIGH Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters | Oct 3, 2024 | 8.0 | 23 | NO | NO |
CVE-2024-41590HIGH Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy functi | Oct 3, 2024 | 8.0 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Vigor166
Top CWEs
Versions
No cataloged versions.