Remote Attackers Can Modify Settings or Cause Denial of Service via .cgi Pages in DrayTek Vigor310 Devices Due to Missing Bounds Checks
CVE-2024-41595

8HIGH

Key Information:

Vendor

DrayTek
Status
Vigor3910 Firmware
Vendor
CVE Published:
3 October 2024

What is CVE-2024-41595?

The Vigor310 devices by DrayTek are susceptible to a vulnerability that allows a remote attacker to alter device settings or initiate a denial of service through unverified .cgi pages. This issue arises from inadequate bounds checks on specific read and write operations, making it crucial for users to update their devices and secure their networks against potential exploitation.

References

https://www.forescout.com/resources/draytek14-vulnerabili...
https://www.forescout.com/resources/draybreak-draytek-res...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.