8

CVE-2024-41588

The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Draytek ≫ Vigor2620 Firmware
   Draytek ≫ Vigor2620 Version -
Draytek ≫ Vigor2915 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2915 Version -
Draytek ≫ Vigor2866 Firmware Version < 4.4.5.2
   Draytek ≫ Vigor2866 Version -
Draytek ≫ Vigor2766 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2766 Version -
Draytek ≫ Vigor2865 Firmware Version < 4.4.5.2
   Draytek ≫ Vigor2865 Version -
Draytek ≫ Vigor2765 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2765 Version -
Draytek ≫ Vigor2763 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2763 Version -
Draytek ≫ Vigor2135 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2135 Version -
Draytek ≫ Vigor166 Firmware Version < 4.2.7
   Draytek ≫ Vigor166 Version -
Draytek ≫ Vigor3912 Firmware Version < 4.3.6.1
   Draytek ≫ Vigor3912 Version -
Draytek ≫ Vigor1000b Firmware Version < 4.3.2.8
   Draytek ≫ Vigor1000b Version -
Draytek ≫ Vigor1000b Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor1000b Version -
Draytek ≫ Vigor165 Firmware Version < 4.2.7
   Draytek ≫ Vigor165 Version -
Draytek ≫ Vigor3910 Firmware Version < 4.3.2.8
   Draytek ≫ Vigor3910 Version -
Draytek ≫ Vigor3910 Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor3910 Version -
Draytek ≫ Vigor2962 Firmware Version < 4.3.2.8
   Draytek ≫ Vigor2962 Version -
Draytek ≫ Vigor2962 Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor2962 Version -
Draytek ≫ Vigor2133 Firmware
   Draytek ≫ Vigor2133 Version -
Draytek ≫ Vigor2762 Firmware
   Draytek ≫ Vigor2762 Version -
Draytek ≫ Vigor2832 Firmware
   Draytek ≫ Vigor2832 Version -
Draytek ≫ Vigor2860 Firmware
   Draytek ≫ Vigor2860 Version -
Draytek ≫ Vigor2862 Firmware
   Draytek ≫ Vigor2862 Version -
Draytek ≫ Vigor2925 Firmware
   Draytek ≫ Vigor2925 Version -
Draytek ≫ Vigor2926 Firmware
   Draytek ≫ Vigor2926 Version -
Draytek ≫ Vigor2952 Firmware
   Draytek ≫ Vigor2952 Version -
Draytek ≫ Vigor3220 Firmware
   Draytek ≫ Vigor3220 Version -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.248
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8 2.1 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://www.forescout.com/resources/draybreak-draytek-research/
Third Party Advisory
Mitigation
Technical Description
https://www.forescout.com/resources/draytek14-vulnerabilities
Broken Link