Integer overflow in DrayTek Corp. products - CVE-2024-51139
Published: April 1, 2025
Vulnerability identifier: #VU106350
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-51139
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the CGI parser’s handling of HTTP POST requests’ "Content-Length" header. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Vigor2860 LTE
Vigor2925
Vigor2925 LTE
Vigor2860
Vigor3220
Vigor2952P
Vigor2952
Vigor2620 LTE
VigorLTE 200n
Vigor2762
Vigor2832
Vigor2133
Vigor2862
Vigor2862 LTE
Vigor2926 LTE
Vigor2926
Vigor3910
Vigor2962
Vigor3912
Vigor2915
Vigor2766
Vigor2765
Vigor2135
Vigor2866 LTE
Vigor2866
Vigor2927
Vigor2927 LTE
Vigor2927L-5G
Vigor2865L-5G
Vigor2865 LTE
Vigor2865
Vigor2925
Vigor2925 LTE
Vigor2860
Vigor3220
Vigor2952P
Vigor2952
Vigor2620 LTE
VigorLTE 200n
Vigor2762
Vigor2832
Vigor2133
Vigor2862
Vigor2862 LTE
Vigor2926 LTE
Vigor2926
Vigor3910
Vigor2962
Vigor3912
Vigor2915
Vigor2766
Vigor2765
Vigor2135
Vigor2866 LTE
Vigor2866
Vigor2927
Vigor2927 LTE
Vigor2927L-5G
Vigor2865L-5G
Vigor2865 LTE
Vigor2865
How to mitigate CVE-2024-51139
Install update from vendor's website.
Vigor2860 LTE - update to 3.9.8.3
Vigor2925 - update to 3.9.8.3
Vigor2925 LTE - update to 3.9.8.3
Vigor2860 - update to 3.9.8.3
Vigor3220 - update to 3.9.8.5
Vigor2952P - update to 3.9.8.5
Vigor2952 - update to 3.9.8.5
Vigor2620 LTE - update to 3.9.9.1
VigorLTE 200n - update to 3.9.9.1
Vigor2762 - update to 3.9.9.2
Vigor2832 - update to 3.9.9.2
Vigor2133 - update to 3.9.9.2
Vigor2862 - update to 3.9.9.8
Vigor2862 LTE - update to 3.9.9.8
Vigor2926 LTE - update to 3.9.9.8
Vigor2926 - update to 3.9.9.8
Vigor3910 - addressed in versions 4.3.2.9, 4.4.3.2
Vigor2962 - addressed in versions 4.3.2.9, 4.4.3.2
Vigor3912 - addressed in versions 4.3.6.2, 4.4.3.2
Vigor2915 - update to 4.4.5
Vigor2766 - update to 4.4.5.5
Vigor2765 - update to 4.4.5.5
Vigor2135 - update to 4.4.5.5
Vigor2866 LTE - update to 4.4.5.8
Vigor2866 - update to 4.4.5.8
Vigor2927 - update to 4.4.5.8
Vigor2927 LTE - update to 4.4.5.8
Vigor2927L-5G - update to 4.4.5.8
Vigor2865L-5G - update to 4.4.5.8
Vigor2865 LTE - update to 4.4.5.8
Vigor2865 - update to 4.4.5.8
Vigor2925 - update to 3.9.8.3
Vigor2925 LTE - update to 3.9.8.3
Vigor2860 - update to 3.9.8.3
Vigor3220 - update to 3.9.8.5
Vigor2952P - update to 3.9.8.5
Vigor2952 - update to 3.9.8.5
Vigor2620 LTE - update to 3.9.9.1
VigorLTE 200n - update to 3.9.9.1
Vigor2762 - update to 3.9.9.2
Vigor2832 - update to 3.9.9.2
Vigor2133 - update to 3.9.9.2
Vigor2862 - update to 3.9.9.8
Vigor2862 LTE - update to 3.9.9.8
Vigor2926 LTE - update to 3.9.9.8
Vigor2926 - update to 3.9.9.8
Vigor3910 - addressed in versions 4.3.2.9, 4.4.3.2
Vigor2962 - addressed in versions 4.3.2.9, 4.4.3.2
Vigor3912 - addressed in versions 4.3.6.2, 4.4.3.2
Vigor2915 - update to 4.4.5
Vigor2766 - update to 4.4.5.5
Vigor2765 - update to 4.4.5.5
Vigor2135 - update to 4.4.5.5
Vigor2866 LTE - update to 4.4.5.8
Vigor2866 - update to 4.4.5.8
Vigor2927 - update to 4.4.5.8
Vigor2927 LTE - update to 4.4.5.8
Vigor2927L-5G - update to 4.4.5.8
Vigor2865L-5G - update to 4.4.5.8
Vigor2865 LTE - update to 4.4.5.8
Vigor2865 - update to 4.4.5.8