CVE-2024-41592
03.10.2024, 19:15
DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.Enginsight
| Vendor | Product | Version |
|---|---|---|
| draytek | vigor2952_firmware | 𝑥 < 3.9.8.2 |
| draytek | vigor2620_firmware | 𝑥 < 3.9.8.9 |
| draytek | vigor2915_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2866_firmware | 𝑥 < 4.4.5.2 |
| draytek | vigor2766_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2865_firmware | 𝑥 < 4.4.5.2 |
| draytek | vigor2765_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2763_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2135_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor166_firmware | 𝑥 < 4.2.7 |
| draytek | vigor3912_firmware | 𝑥 < 4.3.6.1 |
| draytek | vigor1000b_firmware | 𝑥 < 4.3.2.8 |
| draytek | vigor1000b_firmware | 4.4.0.0 ≤ 𝑥 < 4.4.3.1 |
| draytek | vigor165_firmware | 𝑥 < 4.2.7 |
| draytek | vigor3910_firmware | 𝑥 < 4.3.2.8 |
| draytek | vigor3910_firmware | 4.4.0.0 ≤ 𝑥 < 4.4.3.1 |
| draytek | vigor2962_firmware | 𝑥 < 4.3.2.8 |
| draytek | vigor2962_firmware | 4.4.0.0 ≤ 𝑥 < 4.4.3.1 |
| draytek | vigorlte200_firmware | 𝑥 < 3.9.8.9 |
| draytek | vigor2133_firmware | 𝑥 < 3.9.9 |
| draytek | vigor2762_firmware | 𝑥 < 3.9.9 |
| draytek | vigor2832_firmware | 𝑥 < 3.9.9 |
| draytek | vigor2860_firmware | 𝑥 < 3.9.8 |
| draytek | vigor2862_firmware | 𝑥 < 3.9.9.5 |
| draytek | vigor2925_firmware | 𝑥 < 3.9.8 |
| draytek | vigor2926_firmware | 𝑥 < 3.9.9.5 |
| draytek | vigor3220_firmware | 𝑥 < 3.9.8.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration