CVE-2024-51139

CRITICAL EPSS 60.8%
Published Feb 27, 20251y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Feb 27, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
60.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-120

Affected Products 48

VendorProductVersionRange
draytekvigor2620_firmware* <3.9.9.1
draytekvigor2620*any
draytekvigorlte200_firmware* <3.9.9.1
draytekvigorlte200*any
draytekvigor2860_firmware* <3.9.8.3
draytekvigor2860*any
draytekvigor2925_firmware* <3.9.8.3
draytekvigor2925*any
draytekvigor2862_firmware* <3.9.9.8
draytekvigor2862*any
draytekvigor2926_firmware* <3.9.9.8
draytekvigor2926*any
draytekvigor2133_firmware* <3.9.9.2
draytekvigor2133*any
draytekvigor2762_firmware* <3.9.9.2
draytekvigor2762*any
draytekvigor2832_firmware* <3.9.9.2
draytekvigor2832*any
draytekvigor2135_firmware* <4.4.5.5
draytekvigor2135*any
draytekvigor2765_firmware* <4.4.5.5
draytekvigor2765*any
draytekvigor2766_firmware* <4.4.5.5
draytekvigor2766*any
draytekvigor2763_firmware* <4.4.5.5
draytekvigor2763*any
draytekvigor2865_firmware* <4.4.5.8
draytekvigor2865*any
draytekvigor2866_firmware* <4.4.5.8
draytekvigor2866*any
draytekvigor2927_firmware* <4.4.5.8
draytekvigor2927*any
draytekvigor2962_firmware* <4.3.2.9
draytekvigor2962_firmware*≥4.4.3  –  <4.4.3.2
draytekvigor2962*any
draytekvigor3910_firmware* <4.3.2.9
draytekvigor3910_firmware*≥4.4.3  –  <4.4.3.2
draytekvigor3910*any
draytekvigor3912_firmware* <4.4.3.2
draytekvigor3912*any
draytekvigor2915_firmware* <4.4.5
draytekvigor2915*any
draytekvigor1000b_firmware* <4.4.3.2
draytekvigor1000b*any
draytekvigor2952_firmware* <3.9.8.5
draytekvigor2952*any
draytekvigor3220_firmware* <3.9.8.5
draytekvigor3220*any

References 2

  • draytek.com http://draytek.com
    Product
  • medium.com https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.