CVE-2020-28968
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS...
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
- Record
CVE-2020-28968- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
- Record
CVE-2020-28968- Updated
- 2026-11-02
EUVDEUVD-2020-21353 No score
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
- Record
EUVD-2020-21353- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vr5f-m5f2-8mpp No score
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS...
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
- Record
GHSA-vr5f-m5f2-8mpp- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
- draytek vigorap 1000c firmware
- draytek vigorap 700 firmware
- draytek vigorap 710 firmware
- draytek vigorap 800 firmware
- draytek vigorap 802 firmware
- draytek vigorap 810 firmware
- draytek vigorap 900 firmware
- draytek vigorap 902 firmware
- draytek vigorap 903 firmware
- draytek vigorap 910c firmware
- draytek vigorap 912c firmware
- draytek vigorap 918r firmware
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-28968 is a medium vulnerability (CVSS 5.4) in Draytek Vigorap 1000c Firmware, published October 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. No source names a fixed version.