PT-2024-7434 · Draytek · Draytek Vigor310

Published

2024-10-02

·

Updated

2025-06-11

·

CVE-2024-41596

CVSS v3.1

8.0

High

VectorAV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions through 4.3.2.6
Description: The issue is related to a buffer overflow vulnerability in the web interface of DrayTek Vigor routers, caused by improper handling of input data. This can be exploited by a remote attacker to execute arbitrary code or cause a denial of service by sending a specially crafted POST request. The vulnerability exists due to the incorrect retrieval and handling of CGI form parameters in the Vigor management UI.
Recommendations: For DrayTek Vigor310 versions through 4.3.2.6, update to a version later than 4.3.2.6 to resolve the issue. As a temporary workaround, consider restricting access to the Vigor management UI to minimize the risk of exploitation. Avoid using the vulnerable CGI form parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-08812
CVE-2024-41596

Affected Products

Draytek Vigor310