CVE-2020-28968

Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
References
Link Resource
https://www.vulnerability-lab.com/get_content.php?id=2244 Exploit Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:draytek:vigorap_1000c_firmware:1.3.2:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_1000c:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:draytek:vigorap_700_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_700:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:draytek:vigorap_710_firmware:1.2.5:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_710:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:draytek:vigorap_800_firmware:1.1.4:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_800:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:draytek:vigorap_802_firmware:1.3.2:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_802:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:draytek:vigorap_810_firmware:1.2.5:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_810:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:draytek:vigorap_900_firmware:1.2.0:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_900:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:draytek:vigorap_902_firmware:1.2.5:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_902:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:draytek:vigorap_903_firmware:1.3.1:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_903:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:draytek:vigorap_910c_firmware:1.2.5:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_910c:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:draytek:vigorap_912c_firmware:1.3.2:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_912c:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:draytek:vigorap_918r_firmware:1.3.2:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_918r:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:draytek:vigorap_920r_firmware:1.3.0:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigorap_920r:-:*:*:*:*:*:*:*

Information

Published : 2021-10-22 13:15

Updated : 2021-10-28 09:48


NVD link : CVE-2020-28968

Mitre link : CVE-2020-28968


JSON object : View

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

dedicated server usa

Products Affected

draytek

  • vigorap_802
  • vigorap_918r_firmware
  • vigorap_1000c
  • vigorap_902_firmware
  • vigorap_912c
  • vigorap_1000c_firmware
  • vigorap_710_firmware
  • vigorap_903
  • vigorap_918r
  • vigorap_903_firmware
  • vigorap_700
  • vigorap_800_firmware
  • vigorap_912c_firmware
  • vigorap_920r
  • vigorap_902
  • vigorap_900_firmware
  • vigorap_910c
  • vigorap_920r_firmware
  • vigorap_910c_firmware
  • vigorap_900
  • vigorap_710
  • vigorap_700_firmware
  • vigorap_810_firmware
  • vigorap_802_firmware
  • vigorap_810
  • vigorap_800