Vulnerabilities

Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.

GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list.

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to not utilize certificate verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution.

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to utilize insecure versions of the functions strcmp and memcmp, allowing attackers to possibly obtain sensitive information via timing attacks.

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to store passwords in plaintext.

A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request.

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution.

An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/compaction: fix UBSAN shift-out-of-bounds warning<br /> <br /> syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING<br /> <br /> hrtimers are migrated away from the dying CPU to any online target at<br /> the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers<br /> handling tasks involved in the CPU hotplug forward progress.<br /> <br /> However wakeups can still be performed by the outgoing CPU after<br /> CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being<br /> armed. Depending on several considerations (crystal ball power management<br /> based election, earliest timer already enqueued, timer migration enabled or<br /> not), the target may eventually be the current CPU even if offline. If that<br /> happens, the timer is eventually ignored.<br /> <br /> The most notable example is RCU which had to deal with each and every of<br /> those wake-ups by deferring them to an online CPU, along with related<br /> workarounds:<br /> <br /> _ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying)<br /> _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU)<br /> _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq)<br /> <br /> The problem isn&amp;#39;t confined to RCU though as the stop machine kthread<br /> (which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end<br /> of its work through cpu_stop_signal_done() and performs a wake up that<br /> eventually arms the deadline server timer:<br /> <br /> WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0<br /> CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted<br /> Stopper: multi_cpu_stop+0x0/0x120

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> block: mark GFP_NOIO around sysfs -&gt;store()<br /> <br /> sysfs -&gt;store is called with queue freezed, meantime we have several<br /> -&gt;store() callbacks(update_nr_requests, wbt, scheduler) to allocate<br /> memory with GFP_KERNEL which may run into direct reclaim code path,<br /> then potential deadlock can be caused.<br /> <br /> Fix the issue by marking NOIO around sysfs -&gt;store()

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.