High

DATE	CVE	VULNERABILITY TITLE	RISK
2023-11-22	CVE-2023-6265	Path Traversal vulnerability in Draytek Vigor2960 Firmware 1.5.1.4/1.5.1.5 UNSUPPORTED WHEN ASSIGNED Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. network low complexity draytek CWE-22	8.1
2023-03-15	CVE-2023-24229	Command Injection vulnerability in Draytek Vigor2960 Firmware 1.5.1.4 DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. local low complexity draytek CWE-77	7.8
2020-12-31	CVE-2020-19664	OS Command Injection vulnerability in Draytek Vigor2960 Firmware 1.3.1/1.5.1 DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi. network low complexity draytek CWE-78	8.8