Skip to content

Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

DrayTek: actively exploited vulnerabilities

5 vulnerabilities in DrayTek products (Vigor (routers), VigorConnect) are in CISA’s catalog of exploited vulnerabilities. Last added: May 15, 2025.

DrayTek security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

0 vulnerabilities added in the last 12 months
5 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one DrayTek category to your radar, or open its page.

Home and small-office routers, cameras and IoT 5 vulnerabilities

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Vigor (routers) 3 vulnerabilities · Home routers and IoT
VigorConnect 2 vulnerabilities · Home routers and IoT

Name used by CISA: DrayTek. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this DrayTek list.

Rank 1DrayTek Vigor (routers)
CVE-2024-12987
DrayTek Vigor Routers OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
May 15, 2025
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 2DrayTek Vigor (routers)
CVE-2020-15415
CVE from 2020, added in 2024
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 30, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 3DrayTek Vigor (routers)
CVE-2020-8515
Multiple DrayTek Vigor Routers Web Management Page Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 4DrayTek VigorConnect
CVE-2021-20123
CVE from 2021, added in 2024
Draytek VigorConnect Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 3, 2024
CISA deadline
21 days
CVSS severity
7.5 (high)
Rank 5DrayTek VigorConnect
CVE-2021-20124
CVE from 2021, added in 2024
Draytek VigorConnect Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 3, 2024
CISA deadline
21 days
CVSS severity
7.5 (high)

Get new DrayTek vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.