What’s Vulnerable › Vulnerabilities

CVE-2020-28968

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-22 · updated 2026-06-17
• Weakness: CWE-79

Description

Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.

Affected products

• DrayTek Vigorap 1000C Firmware: 1.3.2
• DrayTek Vigorap 700 Firmware: 1.11
• DrayTek Vigorap 710 Firmware: 1.2.5
• DrayTek Vigorap 800 Firmware: 1.1.4
• DrayTek Vigorap 802 Firmware: 1.3.2
• DrayTek Vigorap 810 Firmware: 1.2.5
• DrayTek Vigorap 900 Firmware: 1.2.0
• DrayTek Vigorap 902 Firmware: 1.2.5
• DrayTek Vigorap 903 Firmware: 1.3.1
• DRAYTEK CORP. VigorAP910C: 1.2.5
• DrayTek Vigorap 912C Firmware: 1.3.2
• DrayTek Vigorap 918R Firmware: 1.3.2
• DrayTek Vigorap 920R Firmware: 1.3.0

References

• https://www.vulnerability-lab.com/get_content.php?id=2244
• https://www.vulnerability-lab.com/get_content.php?id=2244

Get alerted when CVE-2020-28968 or the next vulnerability affects your stack