CVE-2024-41590: draytek vigor1000b_firmware Stack-based Buffer Overflow

Vulnerability summary

CVE-2024-41590 is a high (CVSS 8.0) Stack-based Buffer Overflow vulnerability in draytek vigor1000b_firmware. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.7% of scored vulnerabilities.

Timeline

1. 03-10-2024
   PublishedVulnerability first disclosed.
2. 03-10-2024
   Last modifiedVulnerability information updated.

Description

Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).