NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Draytek Vigor routers
view advisory published 2024-10-04
Draytek heeft kwetsbaarheden verholpen in diverse typen routers uit de Vigor-serie.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-41596US | — | — | ||
Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters… | ||||
| CVE-2024-41595US | — | — | ||
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds checks on read and write o… | ||||
| CVE-2024-41594US | high7.5 | — | ||
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for… | ||||
| CVE-2024-41593US | critical9.8 | — | ||
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the… | ||||
| CVE-2024-41592US | — | — | ||
DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key… | ||||
| CVE-2024-41591US | medium6.1 | — | ||
DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS. | ||||
| CVE-2024-41590US | — | — | ||
Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy functi… | ||||
| CVE-2024-41589US | —OT elevated | — | ||
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests. | ||||
| CVE-2024-41588US | — | — | ||
The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of missing bounds checki… | ||||
| CVE-2024-41587US | medium5.4 | — | ||
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6. | ||||
| CVE-2024-41586US | — | — | ||
A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ip… | ||||
| CVE-2024-41585US | — | — | ||
DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escape from the emulated i… | ||||
| CVE-2024-41584US | — | — | ||
DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter. | ||||
| CVE-2024-41583US | — | — | ||
DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitization of the router name. | ||||
02
references
External citations — patches, advisories, analysis.
- Reference - ncscclearexternal
- Reference - cveprojectv5; hkcert; nvdexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan