#VU106350 Integer overflow in DrayTek Corp. products - CVE-2024-51139

Vulnerability identifier: #VU106350

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2024-51139

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Vigor2620 LTE
VigorLTE 200n
Vigor2133
Vigor2135
Vigor2762
Vigor2765
Vigor2766
Vigor2832
Vigor2860
Vigor2860 LTE
Vigor2862
Vigor2862 LTE
Vigor2865
Vigor2865 LTE
Vigor2865L-5G
Vigor2866
Vigor2866 LTE
Vigor2915
Vigor2925
Vigor2925 LTE
Vigor2926
Vigor2926 LTE
Vigor2927
Vigor2927 LTE
Vigor2927L-5G
Vigor2952
Vigor2952P
Vigor2962
Vigor3220
Vigor3910
Vigor3912

Software vendor:
DrayTek Corp.

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the CGI parser’s handling of HTTP POST requests’ "Content-Length" header. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

• http://draytek.com
• https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
• https://www.draytek.com/about/security-advisory/buffer-overflow-vulnerabilities-(cve-2024-51138-cve-...