2
CVEs
1
Critical
0
High
0
KEV
1
PoC
0
Unpatched C/H
50.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
0
LOW
1
Monthly CVE Trend
Affected Products (30)
Vigor3910 Firmware
60
Vigor3900 Firmware
46
Vigor2960 Firmware
19
Vigor2962 Firmware
17
Vigor2925 Firmware
17
Vigor2135 Firmware
16
Vigor2866 Firmware
16
Vigor2133 Firmware
16
Vigor2865 Firmware
16
Vigor2765 Firmware
16
Vigor2762 Firmware
16
Vigor2862 Firmware
16
Vigor2832 Firmware
16
Vigor2766 Firmware
16
Vigor2926 Firmware
16
Vigor166 Firmware
15
Vigor2860 Firmware
15
Vigor165 Firmware
15
Vigor2620 Firmware
15
Vigor300b Firmware
15
Vigor3912 Firmware
14
Vigorlte200 Firmware
14
Vigor1000B Firmware
13
Vigor3220 Firmware
12
Vigor2952 Firmware
12
Vigor2915 Firmware
12
Vigor2763 Firmware
11
Vigor2927 Firmware
8
Vigorconnect
7
Vigor2927Ax Firmware
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-50994 | DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. | CRITICAL | 9.2 | 0.1% | 46 |
|
| CVE-2026-3040 | Command injection in DrayTek Vigor 300B firmware up to version 1.5.1.6 allows authenticated remote attackers to execute arbitrary OS commands via the File parameter in the web management interface. Public exploit code exists for this vulnerability, though the vendor has confirmed the product is end-of-life and no patch will be released. This affects only unsupported installations with administrative access. | LOW | 2.0 | 0.3% | 30 |
PoC
No patch
|