By year
13
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Draytek flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2024-12987 DrayTek Vigor Routers OS Command InjectionExploited since May 15, 2025 · CVSS 6.9
- CVE-2020-15415 DrayTek Multiple Vigor Routers OS Command InjectionExploited since Sep 30, 2024 · CVSS 9.8
- CVE-2021-20124 Draytek VigorConnect Path Traversal Vulnerability Exploited since Sep 3, 2024 · CVSS 7.5
- CVE-2021-20123 Draytek VigorConnect Path Traversal Vulnerability Exploited since Sep 3, 2024 · CVSS 7.5
- CVE-2020-8515 Multiple DrayTek Vigor Routers Web Management PageExploited since Nov 3, 2021 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-113391 A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218.High 8.6 · Oct 20, 2026
- CVE-2026-113390 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218.High 8.6 · Oct 20, 2026
- CVE-2026-113389 A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218.High 8.6 · Oct 20, 2026
- CVE-2026-71943 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function.High 8.6 · Aug 24, 2026
- CVE-2026-71942 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function.High 8.6 · Aug 24, 2026
- CVE-2026-71941 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function.High 8.6 · Aug 24, 2026
- CVE-2026-71940 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function.High 8.6 · Aug 24, 2026
- CVE-2026-71939 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function.High 8.6 · Aug 24, 2026
- CVE-2026-71938 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function.High 8.6 · Aug 24, 2026
- CVE-2026-71937 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function.High 8.6 · Aug 24, 2026
- CVE-2026-71936 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function.High 8.6 · Aug 24, 2026
- CVE-2026-71935 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function.High 8.6 · Aug 24, 2026
- CVE-2026-71934 Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function.High 8.6 · Aug 24, 2026
- CVE-2026-71933 Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions.High 8.8 · Aug 24, 2026
- CVE-2026-71931 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function.High 8.6 · Aug 24, 2026
- CVE-2026-71930 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function.High 8.6 · Aug 24, 2026
- CVE-2026-71929 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function.High 8.6 · Aug 24, 2026
- CVE-2026-71928 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function.High 8.6 · Aug 24, 2026
- CVE-2026-71927 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function.High 8.6 · Aug 24, 2026
- CVE-2026-71926 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function.High 8.6 · Aug 24, 2026
- CVE-2026-71925 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function.High 8.6 · Aug 24, 2026
- CVE-2026-71924 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function.High 8.6 · Aug 24, 2026
- CVE-2026-71923 Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function.High 8.6 · Aug 24, 2026
- CVE-2026-71922 Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface.High 8.7 · Aug 24, 2026
- CVE-2026-71921 Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface.Critical 9.3 · Aug 24, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.