Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and ea

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• draytek vigor1000b firmwarebefore 4.4.3.2
• draytek vigor2133 firmwarebefore 3.9.9.2
• draytek vigor2135 firmwarebefore 4.4.5.5
• draytek vigor2620 firmwarebefore 3.9.9.1
• draytek vigor2762 firmwarebefore 3.9.9.2
• draytek vigor2763 firmwarebefore 4.4.5.5
• draytek vigor2765 firmwarebefore 4.4.5.5
• draytek vigor2766 firmwarebefore 4.4.5.5
• draytek vigor2832 firmwarebefore 3.9.9.2
• draytek vigor2860 firmwarebefore 3.9.8.3
• draytek vigor2862 firmwarebefore 3.9.9.8
• draytek vigor2865 firmwarebefore 4.4.5.8
• draytek vigor2866 firmwarebefore 4.4.5.8
• draytek vigor2915 firmwarebefore 4.4.5
• draytek vigor2925 firmwarebefore 3.9.8.3
• draytek vigor2926 firmwarebefore 3.9.9.8
• draytek vigor2927 firmwarebefore 4.4.5.8
• draytek vigor2952 firmwarebefore 3.9.8.5
• draytek vigor2962 firmware4.4.3 and later · before 4.4.3.2
• draytek vigor2962 firmwarebefore 4.3.2.9

Other highest-scoring records for the same primary product.

• CVE-2023-31447user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted pay
  39Monitor
• CVE-2024-41596Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval
  32Monitor
• CVE-2024-41588The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated
  32Monitor
• CVE-2024-41594An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigo
  30Monitor
• CVE-2024-41591DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.