LastPatch
EN

Is the DrayTek Vigor3900 still getting security updates?

The DrayTek Vigor3900 stopped receiving security updates on 9 March 2026. New vulnerabilities will not be fixed.

The date after which a device gets no more security fixes is also called its end of life (EOL) or end of support.

No longer supported

Security updates ended on

9 March 2026
Device
DrayTek Vigor3900 (router)
Basis
Official end date published by the manufacturer.
As written
EoL Date 09/03/2026
Source
DrayTek UK Product Lifecycle (UK statement)

What to do. Attackers are using known flaws in this model. Replace it. Until then, turn off remote administration and UPnP, and keep it off the Internet.

Vulnerabilities attackers are using

The U.S. cybersecurity agency (CISA) lists these vulnerabilities as actively exploited. Its description names the affected hardware versions when they are known.

  • CVE-2020-15415: DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
  • CVE-2020-8515: DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
  • CVE-2024-12987: DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

Support timeline

2025202620272028All versionsToday
Security updates per hardware version, to scale. The bar ends on the manufacturer's date.

Questions

Is the DrayTek Vigor3900 still getting security updates?

The DrayTek Vigor3900 stopped receiving security updates on 9 March 2026. New vulnerabilities will not be fixed.

Is the DrayTek Vigor3900 affected by vulnerabilities attackers are using?

Yes. The CISA catalogue of exploited vulnerabilities lists CVE-2020-15415, CVE-2020-8515, CVE-2024-12987 for this model. Check the affected hardware versions and install the latest firmware, or replace the device if it is no longer supported.

What does end of life mean for the DrayTek Vigor3900?

After its end of life, the DrayTek Vigor3900 receives no more security fixes from DrayTek. It keeps working, but any vulnerability found later stays open, which makes it an easy target once attackers know about it.

Where does this date come from?

From the manufacturer: DrayTek UK Product Lifecycle. Each date is shown exactly as published.

Every DrayTek device   Routers from every brand