CVE-2026-3040

A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that "300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it." This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-77
• CWE-78
• CWE-78

• https://github.com/master-abc/cve/issues/42Exploit, Issue Tracking
• https://vuldb.com/?ctiid.347394Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.347394Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.757126Third Party Advisory, VDB Entry

Published

Feb 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30363flipperzero-firmware commit ad2a80 was discovered to contain…8.4
• CVE-2026-30364CentSDR commit e40795 was discovered to contain a stack over…7.5
• CVE-2026-30368A client-side authorization flaw in Lightspeed Classroom v5.…5.4
• CVE-2026-3037An OS command injection vulnerability exists in XWEB Pro ver…8.8
• CVE-2026-3038The rtsock_msg_buffer() function serializes routing informat…7.5
• CVE-2026-3039BIND servers that are configured to use TKEY-based authentic…7.5
• CVE-2026-30402An issue in wgcloud v.2.3.7 and before allows a remote attac…9.8
• CVE-2026-30403There is an arbitrary file read vulnerability in the test co…7.5
• CVE-2026-30404The backend database management connection test feature in w…7.5
• CVE-2026-30405An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to…7.5
• CVE-2026-30407Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2026-3041A security vulnerability has been detected in xingfuggz Bayk…2.4