VulnerabilityModified

CVE-2024-51138

CRITICAL 9.8EPSS 1.05%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.05% probability · 62th percentile
CISA KEV: Not listed
Weakness: CWE-121
Affected: draytek/vigor3912 firmware · draytek/vigor2620 firmware · draytek/vigorlte200 firmware · draytek/vigor2860 firmware · draytek/vigor2925 firmware · draytek/vigor2862 firmware · draytek/vigor2926 firmware · draytek/vigor2133 firmware · draytek/vigor2762 firmware · draytek/vigor2832 firmware · draytek/vigor2135 firmware · draytek/vigor2765 firmware · draytek/vigor2766 firmware · draytek/vigor2763 firmware · draytek/vigor2865 firmware · draytek/vigor2866 firmware · draytek/vigor2927 firmware · draytek/vigor2962 firmware · draytek/vigor3910 firmware · draytek/vigor2915 firmware · +3 more
Source: cve@mitre.org

References

https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.