CVEvulnerability

CVE-2024-41590

8.0 HIGH Published 2024-10-03 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-10-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-121

Description

Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.

Affected configurations

• draytek vigor2765 firmware (< 4.4.5.3) • draytek vigor2763 firmware (< 4.4.5.3) • draytek vigor2135 firmware (< 4.4.5.3) • draytek vigor166 firmware (< 4.2.7) • draytek vigor3912 firmware (< 4.3.6.1) • draytek vigor1000b firmware (< 4.3.2.8) • draytek vigor1000b firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor165 firmware (< 4.2.7) • draytek vigor3910 firmware (< 4.3.2.8) • draytek vigor3910 firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor2962 firmware (< 4.3.2.8) • draytek vigor2962 firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigorlte200 firmware • draytek vigor2133 firmware • draytek vigor2762 firmware • draytek vigor2832 firmware • draytek vigor2860 firmware • draytek vigor2862 firmware • draytek vigor2925 firmware • draytek vigor2926 firmware • draytek vigor2952 firmware • draytek vigor3220 firmware • draytek vigor2620 firmware • draytek vigor2915 firmware (< 4.4.5.3) • draytek vigor2866 firmware (< 4.4.5.2) • draytek vigor2766 firmware (< 4.4.5.3) • draytek vigor2865 firmware (< 4.4.5.2)

Related

Weakness · CWE (1)

  • CWE-121 Stack-based Buffer Overflow weakness

References