CVE-2026-3040
DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection
CVSS Score
4.7
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that "300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it." This vulnerability only affects products that are no longer supported by the maintainer.
| CWE | CWE-78 CWE-77 |
| Vendor | draytek |
| Product | vigor 300b |
| Published | Feb 23, 2026 |
| Last Updated | Feb 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for draytek vigor 300b
Be the first to know when new medium vulnerabilities affecting draytek vigor 300b are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
DrayTek / Vigor 300B
1.5.1.0 1.5.1.1 1.5.1.2 1.5.1.3 1.5.1.4 1.5.1.5 1.5.1.6
References
Credits
🔍 jiefengliang (VulDB User)