Vigor3910 Firmware

Vendor:

First CVE: Aug 29, 2022 · Active for 3 years

60
Total CVEs
More Total CVEs than 99% of tracked products
15.0
Avg CVEs / Year
Higher CVE frequency than 98% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 64% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Vigor3910 Firmware over time

Volume of CVEsAvg CVSS Base Score
First CVE
Aug 29, 2022
3 years ago
Most Recent CVE
Feb 27, 2025
516 days ago

CVE Severity & Scoring

Vigor3910 Firmware60 CVEs
All CVEs353,173 CVEs
MediumHighCritical
Attack Vector
Local1 (1.7%)
Network51 (85.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network8 (13.3%)
Attack Complexity
Low60 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None55 (91.7%)
Unknown0 (0.0%)
Required5 (8.3%)
Privileges Required
Low9 (15.0%)
High1 (1.7%)
None50 (83.3%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (60 CVEs).

60 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2022-32548CRITICAL
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or passwo
Aug 29, 20229.850NONO
CVE-2024-51138CRITICAL
Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; V
Feb 27, 20259.831NONO
CVE-2024-51139CRITICAL
Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and
Feb 27, 20259.829NONO
CVE-2024-41334HIGH
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior
Feb 27, 20258.829NONO
CVE-2023-33778CRITICAL
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below
Jun 1, 20239.828NONO
CVE-2024-41339HIGH
An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7,
Feb 27, 20258.827NONO
CVE-2024-41593CRITICAL
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the
Oct 3, 20249.827NONO
CVE-2024-41592HIGH
DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key
Oct 3, 20248.027NONO
CVE-2024-41340HIGH
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762
Feb 27, 20258.426NONO
CVE-2024-41589HIGH
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
Oct 3, 20248.826NONO
View all 60 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (60 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (60 CVEs).

Media Mentions

Signals from CVEs in this product scope (60 CVEs).

Top CNAs Publishing CVEs For Vigor3910 Firmware

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
4.4.328.60.4%00
4.3.2.6367.50.5%00