PT-2024-7431 · Draytek · Draytek Vigor 3910

Published

2024-10-02

·

Updated

2025-06-11

·

CVE-2024-41588

CVSS v3.1

8.0

High

VectorAV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 versions through 4.3.2.6
Description: The issue is related to a buffer overflow vulnerability in the /cgi-bin/v2x00.cgi and /cgi-bin/cgiwcg.cgi CGI endpoints of the DrayTek Vigor3910 devices' web interface. This vulnerability is caused by a lack of bounds checking on input parameters passed through POST requests to the strncpy function. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code or cause a denial of service by sending a specially crafted HTTP request. The vulnerability can be exploited by authenticated users.
Recommendations: For DrayTek Vigor3910 versions through 4.3.2.6, consider disabling access to the /cgi-bin/v2x00.cgi and /cgi-bin/cgiwcg.cgi endpoints until a patch is available. Restrict access to these endpoints to minimize the risk of exploitation. Avoid using parameters that may trigger the buffer overflow vulnerability in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-08809
CVE-2024-41588

Affected Products

Draytek Vigor 3910