CVE-2024-41588: The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of…

PriorityP342high8CVSS 3.1

AVAACLPRLUINSUCHIHAH

EPSS

0.32%

23.6th percentile

The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strncpy function.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
draytek	vigor1000b_firmware	< 4.3.2.8	4.3.2.8
draytek	vigor1000b_firmware	>= 4.4.0.0 < 4.4.3.1	4.4.3.1
draytek	vigor165_firmware	< 4.2.7	4.2.7
draytek	vigor166_firmware	< 4.2.7	4.2.7
draytek	vigor2135_firmware	< 4.4.5.3	4.4.5.3
draytek	vigor2763_firmware	< 4.4.5.3	4.4.5.3
draytek	vigor2765_firmware	< 4.4.5.3	4.4.5.3
draytek	vigor2766_firmware	< 4.4.5.3	4.4.5.3
draytek	vigor2865_firmware	< 4.4.5.2	4.4.5.2
draytek	vigor2866_firmware	< 4.4.5.2	4.4.5.2
draytek	vigor2915_firmware	< 4.4.5.3	4.4.5.3
draytek	vigor2962_firmware	< 4.3.2.8	4.3.2.8
draytek	vigor2962_firmware	>= 4.4.0.0 < 4.4.3.1	4.4.3.1
draytek	vigor3910_firmware	< 4.3.2.8	4.3.2.8
draytek	vigor3910_firmware	>= 4.4.0.0 < 4.4.3.1	4.4.3.1
draytek	vigor3912_firmware	< 4.3.6.1	4.3.6.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.