CVE-2024-51139: Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and…

PriorityP356critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.08%

60.8th percentile

Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
draytek	vigor1000b_firmware	< 4.4.3.2	4.4.3.2
draytek	vigor2133_firmware	< 3.9.9.2	3.9.9.2
draytek	vigor2135_firmware	< 4.4.5.5	4.4.5.5
draytek	vigor2620_firmware	< 3.9.9.1	3.9.9.1
draytek	vigor2762_firmware	< 3.9.9.2	3.9.9.2
draytek	vigor2763_firmware	< 4.4.5.5	4.4.5.5
draytek	vigor2765_firmware	< 4.4.5.5	4.4.5.5
draytek	vigor2766_firmware	< 4.4.5.5	4.4.5.5
draytek	vigor2832_firmware	< 3.9.9.2	3.9.9.2
draytek	vigor2860_firmware	< 3.9.8.3	3.9.8.3
draytek	vigor2862_firmware	< 3.9.9.8	3.9.9.8
draytek	vigor2865_firmware	< 4.4.5.8	4.4.5.8
draytek	vigor2866_firmware	< 4.4.5.8	4.4.5.8
draytek	vigor2915_firmware	< 4.4.5	4.4.5
draytek	vigor2925_firmware	< 3.9.8.3	3.9.8.3
draytek	vigor2926_firmware	< 3.9.9.8	3.9.9.8
draytek	vigor2927_firmware	< 4.4.5.8	4.4.5.8
draytek	vigor2952_firmware	< 3.9.8.5	3.9.8.5
draytek	vigor2962_firmware	< 4.3.2.9	4.3.2.9
draytek	vigor2962_firmware	>= 4.4.3 < 4.4.3.2	4.4.3.2
draytek	vigor3220_firmware	< 3.9.8.5	3.9.8.5
draytek	vigor3910_firmware	< 4.3.2.9	4.3.2.9
draytek	vigor3910_firmware	>= 4.4.3 < 4.4.3.2	4.4.3.2
draytek	vigor3912_firmware	< 4.4.3.2	4.4.3.2
draytek	vigorlte200_firmware	< 3.9.9.1	3.9.9.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.