PT-2020-14025 · Draytek · Vigor3900+2

Published 2020-04-12 · Updated 2020-06-30 · CVE-2020-14473

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vigor3900 versions prior to 1.5.1.1 Vigor2960 versions prior to 1.5.1.1 Vigor300B versions prior to 1.5.1.1

Description A stack-based buffer overflow issue has been identified.

Recommendations For Vigor3900 versions prior to 1.5.1.1, update the firmware to version 1.5.1.1 or later. For Vigor2960 versions prior to 1.5.1.1, update the firmware to version 1.5.1.1 or later. For Vigor300B versions prior to 1.5.1.1, update the firmware to version 1.5.1.1 or later.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-11422

CVE-2020-14473

Affected Products

Vigor2960

Vigor300B

Vigor3900

References · 6

• 🔥 https://github.com/Cossack9989/Vulns/blob/master/IoT/CVE-2020-14473.md · Exploit
• 🔥 https://github.com/dexterone/Vigor-poc · Exploit
• https://bdu.fstec.ru/vul/2024-11422 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14473 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14473 · Vendor Advisory
• https://draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473%29 · Note