How many CVEs does DrayTek have?

DrayTek has 137 published CVE records since 2013, including 10 in the last two years.

How many DrayTek CVEs are in CISA KEV?

Yes — 5 of DrayTek's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which DrayTek products have the most CVEs?

The DrayTek products with the most published CVEs are Vigor3910, vigor3910_firmware, vigor3900_firmware, vigor3900, vigor2960_firmware.

What are the most common weakness types in DrayTek CVEs?

DrayTek's CVEs most often map to these CWE weakness types: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for DrayTek vulnerabilities?

Yes — 65 of DrayTek's CVEs have a known public exploit.

How many critical DrayTek vulnerabilities are there?

DrayTek has 31 critical and 90 high-severity CVEs.

What is the average severity of DrayTek CVEs?

The average CVSS base score across DrayTek's scored CVEs is 8.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

137 CVEs

5 in CISA KEV

DrayTek Vulnerabilities

Name: DrayTek vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for DrayTek.

137

Total CVEs

Published

5

In CISA KEV

Exploited in the wild

65

Public exploits

PoC or exploit code

8.1

Avg CVSS

2013–2026

Overview

DrayTek has 137 published CVE records since 2013, of which 5 are in CISA's Known Exploited Vulnerabilities catalog and 65 have a known public exploit. The average CVSS base score across scored CVEs is 8.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting DrayTek products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on DrayTek's vulnerability posture, as a share of its 137 published CVEs.

Average CVSS: 8.1
Critical / high: 88%
Actively exploited (KEV): 4%
Public exploit available: 47%
Patch available: 28%

Severity and exploitation

How the CVSS severity of DrayTek's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical31

High90

Medium16

Low0

In CISA’s Known Exploited Vulnerabilities catalog

5

5 of DrayTek's CVEs are confirmed exploited in the wild.

Public exploits

65

65 of DrayTek's CVEs have a known public exploit available.

Most affected products

The DrayTek products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in DrayTek CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish DrayTek CVE records.

Disclosure activity by year

How many DrayTek CVEs were published each year.

2019

2

2020

13

2021

8

2022

3

2023

9

2024

89

2025

8

2026

2

Latest DrayTek CVEs

The most recently disclosed vulnerabilities affecting DrayTek.

DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi
CWE-78
Critical · CVSS 9.2
EPSS 1.4%2026-05-08
DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection
CWE-78
Medium · CVSS 5.1
EPSS 8.8%2026-02-23
CVE-2025-10547
Critical · CVSS 9.8
EPSS 0.6%2025-10-03
High vulnerability · 2025-08-04
CWE-798
High · CVSS 8.6
EPSS 0.2%2025-08-04
High vulnerability · 2025-02-27
CWE-295
High · CVSS 8.8
EPSS 0.4%2025-02-27
High vulnerability · 2025-02-27
CWE-434
High · CVSS 8.4
EPSS 0.2%2025-02-27
High vulnerability · 2025-02-27
CWE-434
High · CVSS 8.8
EPSS 0.6%2025-02-27
High vulnerability · 2025-02-27
CWE-476
High · CVSS 7.5
EPSS 0.4%2025-02-27
Critical vulnerability · 2025-02-27
CWE-121
Critical · CVSS 9.8
EPSS 1.0%2025-02-27
Critical vulnerability · 2025-02-27
CWE-120
Critical · CVSS 9.8
EPSS 1.0%2025-02-27
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
CISA KEV
CWE-78
Critical · CVSS 9.3
EPSS 98.1%2024-12-27
Medium vulnerability · 2024-12-27
CWE-78
Medium · CVSS 6.9
EPSS 32.8%2024-12-27

Track new DrayTek CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor DrayTek CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Edimax139 CVEs Avaya139 CVEs aws139 CVEs ruby-lang139 CVEs HDFGroup136 CVEs Hitachi Energy136 CVEs themeum136 CVEs xmlsoft136 CVEs

Browse all vendors

Frequently asked questions

Common questions about DrayTek vulnerabilities.

How many CVEs does DrayTek have?: DrayTek has 137 published CVE records since 2013, including 10 in the last two years.
How many DrayTek CVEs are in CISA KEV?: Yes — 5 of DrayTek's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which DrayTek products have the most CVEs?: The DrayTek products with the most published CVEs are Vigor3910, vigor3910_firmware, vigor3900_firmware, vigor3900, vigor2960_firmware.
What are the most common weakness types in DrayTek CVEs?: DrayTek's CVEs most often map to these CWE weakness types: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for DrayTek vulnerabilities?: Yes — 65 of DrayTek's CVEs have a known public exploit.
How many critical DrayTek vulnerabilities are there?: DrayTek has 31 critical and 90 high-severity CVEs.
What is the average severity of DrayTek CVEs?: The average CVSS base score across DrayTek's scored CVEs is 8.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track DrayTek vulnerabilities

Monitor new DrayTek vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing