stack-based overflow in GetCGI function

CVE-2024-41592

Summary

The DrayTek Vigor3910 devices through 4.3.2.6 are affected by a stack-based overflow vulnerability when processing query string parameters, which can be exploited to crash the router or execute remote code. There are 14 newly discovered vulnerabilities in DrayTek Vigor routers, with the most concerning being buffer overflow and OC command injection vulnerabilities. Over 700,000 routers are exposed to the internet, making them easy targets for attackers. The vulnerabilities have been consistently exploited by threat actors, including Chinese APTs. Exploiting these vulnerabilities can lead to data theft, ransomware deployment, and denial-of-service attacks. DrayTek has released patches for the vulnerabilities, and users are urged to update their router firmware to the latest version to protect against these threats.

News Articles

Hackread

CVE-2024-41592CVE-2024-41585

Critical Vulnerabilities Expose Nearly 1 Million DrayTek Routers - PATCH NOW!

Critical security vulnerabilities exposed in DrayTek Vigor routers: Discover how to protect your network from these serious flaws.

The Register

CVE-2024-41592CVE-2024-41585

700K+ DrayTek routers are sitting ducks on the internet

Fourteen newly found bugs in DrayTek Vigor routers — including one critical remote-code-execution flaw that received a perfect 10 out of 10 CVSS severity rating — could be abused by crooks looking to seize...

References