File and Path Handling

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. Draytek VigorConnect 6.0-B3 - Local File InclusionCVE-2021-20124DrayTek · CVSS 7.5 · 96% likely

   CWE-22

2. Draytek VigorConnect 1.6.0-B - Local File InclusionCVE-2021-20123DrayTek · CVSS 7.5 · 90% likely

   CWE-22

3. DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversalCVE-2023-1009DrayTek · CVSS 6.5 · 16% likely

   CWE-22

4. An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated…CVE-2021-20125Draytek · 3.9% likely

   CWE-22

5. DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversalCVE-2023-6265DrayTek · CVSS 6.5 · 1.8% likely

   CWE-22

6. DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversalCVE-2023-1163DrayTek · CVSS 6.5 · 1.8% likely

   CWE-22

7. DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFileCVE-2026-71932DrayTek Corporation · CVSS 4.9 · 1.0% likely

   CWE-22

8. A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information.CVE-2024-23721Draytek · CVSS 7.5 · 0.9% likely

   CWE-22

9. An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7,…CVE-2024-41339Draytek · CVSS 8.8 · 0.6% likely

   CWE-434

10. DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversalCVE-2026-113395DrayTek · CVSS 7.4 · 0.4% likely

    CWE-22

11. DrayTek Vigor2960 Apmupload mainfunction.cgi path traversalCVE-2026-113392DrayTek · CVSS 7.4 · 0.4% likely

    CWE-22

12. DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversalCVE-2026-113394DrayTek · CVSS 7.4 · 0.4% likely

    CWE-22

13. DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted uploadCVE-2026-113393DrayTek · CVSS 6.3 · 0.3% likely

    CWE-434

14. An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/276…CVE-2024-41340Draytek · CVSS 8.4 · 0.2% likely

    CWE-434

15. DrayTek Vigor2960 mainfunction.cgi app_guest_export path traversalCVE-2026-129451DrayTek · CVSS 9.9

    CWE-22

16. DrayTek Vigor2960 mainfunction.cgi sub_1E084 path traversalCVE-2026-129450DrayTek · CVSS 9.9

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.