CVE Feed

    Dashboard / CVE / CVE-2019-16533

    CVE-2019-16533

    On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.

    Published:Sep 20, 2019
    Last Modified:Nov 21, 2024
    EPS:Sep 20, 2019
    EPSS Score:0.0024
    CVSS Score:6.1

    Affected Products

    Vendor
    Draytek
    Product
    Vigor2925 Firmware
    Vendor
    Draytek
    Product
    Vigor2925ac
    Vendor
    Draytek
    Product
    Vigor2925fn
    Vendor
    Draytek
    Product
    Vigor2925n-plus
    Vendor
    Draytek
    Product
    Vigor2925vac
    Vendor
    Draytek
    Product
    Vigor2925vn-plus
    Vendor
    Draytek
    Product
    Vigor 2925
    Vendor
    Draytek
    Product
    Vigor 2925n

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-51139 (CVSS 9.8) — Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and…
    CVE-2024-41334 (CVSS 8.8) — Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to …
    CVE-2024-51138 (CVSS 9.8) — Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2…
    CVE-2024-41338 (CVSS 7.5) — A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.…
    CVE-2024-41339 (CVSS 8.8) — An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , …
    CVE-2024-41340 (CVSS 8.4) — An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29…
    CVE-2024-41592 (CVSS 8) — DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters …
    CVE-2024-41593 (CVSS 9.8) — DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft…
    CVE-2024-41594 (CVSS 7.5) — An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information becaus…
    CVE-2024-41591 (CVSS 6.1) — DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High