What’s Vulnerable › Vulnerabilities
CVE-2024-41588
- Severity: high (CVSS 8.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-10-03 · updated 2026-06-17
- Weakness: CWE-120
Description
The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function.
Affected products
- DrayTek Vigor1000B Firmware: before 4.3.2.8; from 4.4.0.0 before 4.4.3.1 — fixed in 4.3.2.8, 4.4.3.1
- DrayTek Vigor165 Firmware: before 4.2.7 — fixed in 4.2.7
- DrayTek Vigor166 Firmware: before 4.2.7 — fixed in 4.2.7
- DrayTek Vigor2133 Firmware: all versions
- DrayTek Vigor2135 Firmware: before 4.4.5.3 — fixed in 4.4.5.3
- DrayTek Vigor2620 Firmware: all versions
- DrayTek Vigor2762 Firmware: all versions
- DrayTek Vigor2763 Firmware: before 4.4.5.3 — fixed in 4.4.5.3
- DrayTek Vigor2765 Firmware: before 4.4.5.3 — fixed in 4.4.5.3
- DrayTek Vigor2766 Firmware: before 4.4.5.3 — fixed in 4.4.5.3
- DrayTek Vigor2832 Firmware: all versions
- DrayTek Vigor2860 Firmware: all versions
- DrayTek Vigor2862 Firmware: all versions
- DrayTek Vigor2865 Firmware: before 4.4.5.2 — fixed in 4.4.5.2
- DrayTek Vigor2866 Firmware: before 4.4.5.2 — fixed in 4.4.5.2
- DrayTek Vigor2915 Firmware: before 4.4.5.3 — fixed in 4.4.5.3
- DrayTek Vigor2925 Firmware: all versions
- DrayTek Vigor2926 Firmware: all versions
- DrayTek Vigor2952 Firmware: all versions
- DrayTek Vigor2962 Firmware: before 4.3.2.8; from 4.4.0.0 before 4.4.3.1 — fixed in 4.3.2.8, 4.4.3.1
- DrayTek Vigor3220 Firmware: all versions
- DrayTek Vigor3910 Firmware: before 4.3.2.8; from 4.4.0.0 before 4.4.3.1 — fixed in 4.3.2.8, 4.4.3.1
- DrayTek Vigor3912 Firmware: before 4.3.6.1 — fixed in 4.3.6.1
- DrayTek Vigorlte200 Firmware: all versions
How to fix
Upgrade to a fixed version: DrayTek Vigor1000B Firmware 4.3.2.8, 4.4.3.1; DrayTek Vigor165 Firmware 4.2.7; DrayTek Vigor166 Firmware 4.2.7; DrayTek Vigor2135 Firmware 4.4.5.3; DrayTek Vigor2763 Firmware 4.4.5.3; DrayTek Vigor2765 Firmware 4.4.5.3; DrayTek Vigor2766 Firmware 4.4.5.3; DrayTek Vigor2865 Firmware 4.4.5.2; DrayTek Vigor2866 Firmware 4.4.5.2; DrayTek Vigor2915 Firmware 4.4.5.3; DrayTek Vigor2962 Firmware 4.3.2.8, 4.4.3.1; DrayTek Vigor3910 Firmware 4.3.2.8, 4.4.3.1. Check the vendor advisory for mitigations.
References
- https://www.forescout.com/resources/draybreak-draytek-research/
- https://www.forescout.com/resources/draytek14-vulnerabilities
Get alerted when CVE-2024-41588 or the next vulnerability affects your stack