medium5.4
CVE-2020-28968
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module.
Impact
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Draytek | Vigorap 1000c Firmware | Version 1.3.2 |
| Draytek | Vigorap 700 Firmware | Version 1.11 |
| Draytek | Vigorap 710 Firmware | Version 1.2.5 |
| Draytek | Vigorap 800 Firmware | Version 1.1.4 |
| Draytek | Vigorap 802 Firmware | Version 1.3.2 |
| Draytek | Vigorap 810 Firmware | Version 1.2.5 |
| Draytek | Vigorap 900 Firmware | Version 1.2.0 |
| Draytek | Vigorap 902 Firmware | Version 1.2.5 |
| Draytek | Vigorap 903 Firmware | Version 1.3.1 |
| Draytek | Vigorap 910c Firmware | Version 1.2.5 |
| Draytek | Vigorap 912c Firmware | Version 1.3.2 |
| Draytek | Vigorap 918r Firmware | Version 1.3.2 |