« Volver al listado

CVE-2019-16534

Estado: ModificadaMedia (6.1)—

On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Draytek — Vigor2925 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-16534",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-20T16:15:13.617",
  "references": [
    {
      "url": "https://www.draytek.com/about/security-advisory/urgent-security-updates-to-draytek-routers",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.facebook.com/Huang.YuHsiang.Phone/posts/1815316691945755",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.draytek.com/about/security-advisory/urgent-security-updates-to-draytek-routers",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.facebook.com/Huang.YuHsiang.Phone/posts/1815316691945755",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product."
    },
    {
      "lang": "es",
      "value": "En los dispositivos On DrayTek  Vigor2925 con versión de firmware 3.8.4.3, se presenta una vulnerabilidad de tipo XSS por medio de un nombre de WAN diseñado en la pantalla General Setup. NOTA: este es un producto al final de su vida útil."
    }
  ],
  "lastModified": "2026-06-17T02:22:23.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:draytek:vigor2925_firmware:3.8.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06F99492-F7E7-44E5-971F-FEA23B556B34"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:draytek:vigor_2925:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8320C78-49F7-47D5-BD7E-C19B466013A9"
            },
            {
              "criteria": "cpe:2.3:h:draytek:vigor_2925n:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5EF35CFC-7C7F-4225-87B9-FEBA6B27A536"
            },
            {
              "criteria": "cpe:2.3:h:draytek:vigor2925ac:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2AA7A61-2672-425D-89D0-4BE755FA6BFD"
            },
            {
              "criteria": "cpe:2.3:h:draytek:vigor2925fn:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2A4DE43C-8CE1-4DF4-B648-106E1A61C89B"
            },
            {
              "criteria": "cpe:2.3:h:draytek:vigor2925n-plus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E8940245-090F-40AF-A0F5-F56AC2DDCE9A"
            },
            {
              "criteria": "cpe:2.3:h:draytek:vigor2925vac:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F0C0AA77-8B78-425A-B9E8-078B79C4AC66"
            },
            {
              "criteria": "cpe:2.3:h:draytek:vigor2925vn-plus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "216C7078-B72E-46B4-A039-6D3331A5AA13"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}