CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-51139
Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-120
- Published
- Modified
- Record from
- the NVD, synced
Affected
- draytek:vigor1000b_firmware
- draytek:vigor2133_firmware
- draytek:vigor2135_firmware
- draytek:vigor2620_firmware
- draytek:vigor2762_firmware
- draytek:vigor2763_firmware
- draytek:vigor2765_firmware
- draytek:vigor2766_firmware
- draytek:vigor2832_firmware
- draytek:vigor2860_firmware
- draytek:vigor2862_firmware
- draytek:vigor2865_firmware
- draytek:vigor2866_firmware
- draytek:vigor2915_firmware
- draytek:vigor2925_firmware
- draytek:vigor2926_firmware
- draytek:vigor2927_firmware
- draytek:vigor2952_firmware
- draytek:vigor2962_firmware
- draytek:vigor3220_firmware
- draytek:vigor3910_firmware
- draytek:vigor3912_firmware
- draytek:vigorlte200_firmware