{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: DrayTek vulnerabilities","home_page_url":"https://patchfirst.co/vendor/draytek/","feed_url":"https://patchfirst.co/feed/vendor/draytek.json","description":"New and newly exploited DrayTek CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-113391","url":"https://patchfirst.co/cve/CVE-2026-113391/","title":"CVE-2026-113391: A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218","content_text":"DrayTek · Vigor2960. Not in CISA KEV. EPSS 2.1% (higher than 81.3% of CVEs). CVSS 9.9 CRITICAL. Priority 25.1 of 100.","summary":"A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-20T19:27:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.1,"kev":null,"epss":{"score":0.02063,"percentile":0.81337},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Vigor2960","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-113390","url":"https://patchfirst.co/cve/CVE-2026-113390/","title":"CVE-2026-113390: A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218","content_text":"DrayTek · Vigor2960. Not in CISA KEV. EPSS 1.9% (higher than 79.2% of CVEs). CVSS 9.9 CRITICAL. Priority 24.7 of 100.","summary":"A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-22T22:18:03.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.7,"kev":null,"epss":{"score":0.01863,"percentile":0.79243},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Vigor2960","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-113389","url":"https://patchfirst.co/cve/CVE-2026-113389/","title":"CVE-2026-113389: A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218","content_text":"DrayTek · Vigor2960. Not in CISA KEV. EPSS 1.9% (higher than 79.4% of CVEs). CVSS 9.9 CRITICAL. Priority 24.7 of 100.","summary":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-20T19:27:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.7,"kev":null,"epss":{"score":0.0188,"percentile":0.79428},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Vigor2960","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-12987#kev","url":"https://patchfirst.co/cve/CVE-2024-12987/","title":"[KEV] CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability","content_text":"DrayTek · Vigor Routers. In CISA KEV since 2025-05-15. ENISA EUVD lists it as exploited. EPSS 98.2% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"DrayTek Vigor Routers OS Command Injection Vulnerability","date_published":"2025-05-15T00:00:00.000Z","date_modified":"2026-06-17T07:00:55.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-05-15","ransomware":false},"epss":{"score":0.98163,"percentile":0.99914},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Vigor Routers","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-15415#kev","url":"https://patchfirst.co/cve/CVE-2020-15415/","title":"[KEV] CVE-2020-15415: DrayTek Multiple Vigor Routers OS Command Injection Vulnerability","content_text":"DrayTek · Multiple Vigor Routers. In CISA KEV since 2024-09-30. ENISA EUVD lists it as exploited. EPSS 84.5% (higher than 99.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"DrayTek Multiple Vigor Routers OS Command Injection Vulnerability","date_published":"2024-09-30T00:00:00.000Z","date_modified":"2026-06-17T02:56:38.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-09-30","ransomware":false},"epss":{"score":0.8448,"percentile":0.99701},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Multiple Vigor Routers","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-20124#kev","url":"https://patchfirst.co/cve/CVE-2021-20124/","title":"[KEV] CVE-2021-20124: Draytek VigorConnect Path Traversal Vulnerability","content_text":"DrayTek · VigorConnect. In CISA KEV since 2024-09-03. ENISA EUVD lists it as exploited. EPSS 95.9% (higher than 99.87% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Draytek VigorConnect Path Traversal Vulnerability","date_published":"2024-09-03T00:00:00.000Z","date_modified":"2026-06-17T03:33:18.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2024-09-03","ransomware":false},"epss":{"score":0.95917,"percentile":0.99873},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"DrayTek","product":"VigorConnect","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-20123#kev","url":"https://patchfirst.co/cve/CVE-2021-20123/","title":"[KEV] CVE-2021-20123: Draytek VigorConnect Path Traversal Vulnerability","content_text":"DrayTek · VigorConnect. In CISA KEV since 2024-09-03. ENISA EUVD lists it as exploited. EPSS 89.7% (higher than 99.79% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Draytek VigorConnect Path Traversal Vulnerability","date_published":"2024-09-03T00:00:00.000Z","date_modified":"2026-06-17T03:33:18.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2024-09-03","ransomware":false},"epss":{"score":0.89654,"percentile":0.99787},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"DrayTek","product":"VigorConnect","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8515#kev","url":"https://patchfirst.co/cve/CVE-2020-8515/","title":"[KEV] CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability","content_text":"DrayTek · Multiple Vigor Routers. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 69.9 of 100.","summary":"Multiple DrayTek Vigor Routers Web Management Page Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:30.000Z","tags":["kev","public-exploit","T1133","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99993,"percentile":0.99987},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Multiple Vigor Routers","techniqueIds":["T1133","T1059","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}