Vigor2960 Firmware

Vendor:

First CVE: Feb 1, 2020 · Active for 6 years

24
Total CVEs
More Total CVEs than 95% of tracked products
4.8
Avg CVEs / Year
Higher CVE frequency than 88% of tracked products
9.0
Avg CVSS
Higher Avg CVSS than 86% of tracked products
12.5%
KEV Rate
Higher KEV Rate than 99% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Vigor2960 Firmware over time

Volume of CVEsAvg CVSS Base Score
First CVE
Feb 1, 2020
6 years ago
Most Recent CVE
May 8, 2026
81 days ago

CVE Severity & Scoring

Vigor2960 Firmware24 CVEs
All CVEs352,785 CVEs
MediumHighCritical
Attack Vector
Local2 (8.3%)
Network20 (83.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network2 (8.3%)
Attack Complexity
Low23 (95.8%)
High1 (4.2%)
Unknown0 (0.0%)
User Interaction
None24 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low8 (33.3%)
High0 (0.0%)
None16 (66.7%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (24 CVEs).

24 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2020-8515CRITICAL
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via
Feb 1, 20209.898YESYES
CVE-2024-12987CRITICAL
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcf
Dec 27, 20249.897YESYES
CVE-2020-15415CRITICAL
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename wh
Jun 30, 20209.897YESYES
CVE-2020-10826CRITICAL
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mo
Mar 26, 20209.851NONO
CVE-2021-43118CRITICAL
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malf
Mar 29, 20229.849NONO
CVE-2024-12986CRITICAL
A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bi
Dec 27, 20249.848NONO
CVE-2023-1162HIGH
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file main
Mar 3, 20238.840NONO
CVE-2020-10828CRITICAL
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP reques
Mar 26, 20209.835NONO
CVE-2020-10827CRITICAL
A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP reques
Mar 26, 20209.835NONO
CVE-2022-50994HIGH
DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute
May 8, 20268.132NONO
View all 24 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (24 CVEs).

CISA KEV
3 CVEs
12.5% of CVEs· 99th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
3 CVEs
12.5% of CVEs· 97th percentile
ExploitDB
1 CVE
4.2% of CVEs· 86th percentile

Social Chatter

Signals from CVEs in this product scope (24 CVEs).

Media Mentions

Signals from CVEs in this product scope (24 CVEs).

Top CNAs Publishing CVEs For Vigor2960 Firmware

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
1.5.1.518.11.8%00
1.5.1.467.825.0%11
1.5.1.319.834.8%00
1.4.418.00.7%00
1.3.119.8100.0%11