CVEvulnerability

CVE-2024-41592

8.0 HIGH Published 2024-10-03 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-10-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-121

Description

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.

Affected configurations

• draytek vigor2952 firmware (< 3.9.8.2) • draytek vigor2620 firmware (< 3.9.8.9) • draytek vigor2915 firmware (< 4.4.5.3) • draytek vigor2866 firmware (< 4.4.5.2) • draytek vigor2766 firmware (< 4.4.5.3) • draytek vigor2865 firmware (< 4.4.5.2) • draytek vigor2765 firmware (< 4.4.5.3) • draytek vigor2763 firmware (< 4.4.5.3) • draytek vigor2135 firmware (< 4.4.5.3) • draytek vigor166 firmware (< 4.2.7) • draytek vigor3912 firmware (< 4.3.6.1) • draytek vigor1000b firmware (< 4.3.2.8) • draytek vigor1000b firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor165 firmware (< 4.2.7) • draytek vigor3910 firmware (< 4.3.2.8) • draytek vigor3910 firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor2962 firmware (< 4.3.2.8) • draytek vigor2962 firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigorlte200 firmware (< 3.9.8.9) • draytek vigor2133 firmware (< 3.9.9) • draytek vigor2762 firmware (< 3.9.9) • draytek vigor2832 firmware (< 3.9.9) • draytek vigor2860 firmware (< 3.9.8) • draytek vigor2862 firmware (< 3.9.9.5) • draytek vigor2925 firmware (< 3.9.8) • draytek vigor2926 firmware (< 3.9.9.5) • draytek vigor3220 firmware (< 3.9.8.2)

Related

Weakness · CWE (1)

  • CWE-121 Stack-based Buffer Overflow weakness

References