CVE-2020-28968
Medium
Description
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Draytek Vigorap 1000c Firmware
PublishedOct 22, 2021
First seenOct 22, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| draytek vigorap_1000c_firmware | 1.3.2 | — |
| draytek vigorap_700_firmware | 1.11 | — |
| draytek vigorap_710_firmware | 1.2.5 | — |
| draytek vigorap_800_firmware | 1.1.4 | — |
| draytek vigorap_802_firmware | 1.3.2 | — |
| draytek vigorap_810_firmware | 1.2.5 | — |
| draytek vigorap_900_firmware | 1.2.0 | — |
| draytek vigorap_902_firmware | 1.2.5 | — |
| draytek vigorap_903_firmware | 1.3.1 | — |
| draytek vigorap_910c_firmware | 1.2.5 | — |
| draytek vigorap_912c_firmware | 1.3.2 | — |
| draytek vigorap_918r_firmware | 1.3.2 | — |
| draytek vigorap_920r_firmware | 1.3.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.