CVE-2024-41592

HIGH

DrayTek Vigor3910 < 4.3.2.6 - Stack-based Buffer Overflow via GetCGI Query String Parameter

Title source: llm
STIX 2.1

Description

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.

References (2)

Core 2

Scores

CVSS v3 8.0
EPSS 0.0141
EPSS Percentile 69.1%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-121
Status published
Products (24)
draytek/vigor1000b_firmware < 4.3.2.8
draytek/vigor165_firmware < 4.2.7
draytek/vigor166_firmware < 4.2.7
draytek/vigor2133_firmware < 3.9.9
draytek/vigor2135_firmware < 4.4.5.3
draytek/vigor2620_firmware < 3.9.8.9
draytek/vigor2762_firmware < 3.9.9
draytek/vigor2763_firmware < 4.4.5.3
draytek/vigor2765_firmware < 4.4.5.3
draytek/vigor2766_firmware < 4.4.5.3
... and 14 more
Published Oct 03, 2024
Tracked Since Feb 18, 2026