9.8

CVE-2020-14993

Exploit
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Draytek ≫ Vigor300b Firmware Version < 1.5.1.1
   Draytek ≫ Vigor300b Version -
Draytek ≫ Vigor2960 Firmware Version < 1.5.1.1
   Draytek ≫ Vigor2960 Version -
Draytek ≫ Vigor3900 Firmware Version < 1.5.1.1
   Draytek ≫ Vigor3900 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.33% 0.916
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://github.com/dexterone/Vigor-poc
Third Party Advisory
Exploit
https://www.draytek.com/about/security-advisory
Vendor Advisory
https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473%29