Buffer Overflow Vulnerability in DrayTek Vigor3910 Endpoints
CVE-2024-41588

8HIGH

Key Information:

Vendor

DrayTek
Status
Vigor2620 Firmware
Vendor
CVE Published:
3 October 2024

What is CVE-2024-41588?

DrayTek Vigor3910 devices are exposed to a buffer overflow vulnerability due to insufficient bounds checking on parameters received via POST requests in the CGI endpoints v2x00.cgi and cgiwcg.cgi. This vulnerability allows authenticated users to exploit the issue, potentially compromising the device's integrity and network security. Users must be aware of this risk, especially if utilizing affected versions prior to 4.3.2.6.

References

https://www.forescout.com/resources/draytek14-vulnerabili...
https://www.forescout.com/resources/draybreak-draytek-res...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.