PT-2024-6594 · Draytek · Draytek Vigor 3910
Published
2024-10-02
·
Updated
2025-06-03
·
CVE-2024-41592
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
DrayTek Vigor3910 devices through 4.3.2.6
Description:
The issue is a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs. This can be exploited by sending a specially crafted HTTP request, potentially allowing an attacker to execute arbitrary code. The vulnerability is being actively exploited.
Recommendations:
For DrayTek Vigor3910 devices through 4.3.2.6, consider disabling the GetCGI function until a patch is available to prevent exploitation. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the
query string parameters in the affected API endpoint until the issue is resolved. Update to a newer version that contains a fix for this issue once it becomes available.Exploit
Fix
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Draytek Vigor 3910