CVE-2024-51139
Severity CVSS v4.0:
Pending analysis
Type:
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Publication date:
27/02/2025
Last modified:
28/05/2025
Description
Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:draytek:vigor2620_firmware:*:*:*:*:*:*:*:* | 3.9.9.1 (excluding) | |
| cpe:2.3:h:draytek:vigor2620:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigorlte200_firmware:*:*:*:*:*:*:*:* | 3.9.9.1 (excluding) | |
| cpe:2.3:h:draytek:vigorlte200:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:* | 3.9.8.3 (excluding) | |
| cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigor2925_firmware:*:*:*:*:*:*:*:* | 3.9.8.3 (excluding) | |
| cpe:2.3:h:draytek:vigor2925:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:* | 3.9.9.8 (excluding) | |
| cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:* | 3.9.9.8 (excluding) | |
| cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:* | 3.9.9.2 (excluding) | |
| cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:* | 3.9.9.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page