Format String Vulnerability in DrayTek Vigor Routers
CVE-2021-42911

9.8CRITICAL

Key Information:

Vendor
Draytek
Status
Vigor2960 Firmware
Vendor
CVE Published:
29 March 2022

Summary

A Format String vulnerability has been identified in multiple models of DrayTek Vigor routers, including Vigor 2960, Vigor 3900, and Vigor 300B, specifically in the handling of inputs through the mainfunction.cgi file. An attacker could exploit this vulnerability by sending a specially crafted HTTP message with a malformed QUERY STRING, potentially enabling remote execution of arbitrary code on the affected devices. This poses significant risks to network integrity and user data security.

References

https://gist.github.com/Cossack9989/e9c1c2d2e69b773ca4251...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.