CVSS 3.1
8.0 highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-41592
DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-121
- Published
- Modified
- Record from
- the NVD, synced
Affected
- draytek:vigor1000b_firmware
- draytek:vigor165_firmware
- draytek:vigor166_firmware
- draytek:vigor2133_firmware
- draytek:vigor2135_firmware
- draytek:vigor2620_firmware
- draytek:vigor2762_firmware
- draytek:vigor2763_firmware
- draytek:vigor2765_firmware
- draytek:vigor2766_firmware
- draytek:vigor2832_firmware
- draytek:vigor2860_firmware
- draytek:vigor2862_firmware
- draytek:vigor2865_firmware
- draytek:vigor2866_firmware
- draytek:vigor2915_firmware
- draytek:vigor2925_firmware
- draytek:vigor2926_firmware
- draytek:vigor2952_firmware
- draytek:vigor2962_firmware
- draytek:vigor3220_firmware
- draytek:vigor3910_firmware
- draytek:vigor3912_firmware
- draytek:vigorlte200_firmware