Vulnerabilites related to draytek - vigor3910
cve-2024-46594
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:06
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46594",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:03.512176Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:06:52.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:25.648185",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#33c5e76a919e4f04ae8a7bb039e37131"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46594",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:06:52.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-41593
Vulnerability from cvelistv5
Published
2024-10-03 00:00
Modified
2024-10-03 19:13
Severity ?
EPSS score ?
Summary
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41593",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-03T19:12:46.197818Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T19:13:02.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T18:29:21.947598",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-41593",
"datePublished": "2024-10-03T00:00:00",
"dateReserved": "2024-07-18T00:00:00",
"dateUpdated": "2024-10-03T19:13:02.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46557
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:24
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46557",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:44.183026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:24:07.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:22.947749",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#8817e09b31b04ebebdaa5d6df1415df0"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46557",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:24:07.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46553
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:24
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:49.725375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:24:50.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:16.258029",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1e21ab70186245aa8fb17578863216e2"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46553",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:24:50.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46590
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:07
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:09.212199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:07:52.002Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:20.763753",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e0a960e24de649b3a67c21a63592d82f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46590",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:07:52.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46589
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:08
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:10.605586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:08:09.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:19.627260",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e170f53316c740488da5d16f57be1b52"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46589",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:08:09.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46595
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:06
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46595",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:01.805315Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:06:37.351Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:26.116645",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7f26d2119de54d5fbc25a8d3ebe2b16c"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46595",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:06:37.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46593
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:07
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46593",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:04.809151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:07:10.038Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:24.174654",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#f85d41a6875a4853be9a3c457bc81a33"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46593",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:07:10.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46555
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:24
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:46.797482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:24:30.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:20.955966",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e15d03bdd4b9441e8eb157fbd09969f4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46555",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:24:30.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46558
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:23
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:42.851691Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:23:55.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:25.663313",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#43e2ae152385466180ebec957696ceaa"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46558",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:23:55.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46581
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:10
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:20.518392Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:10:25.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:10.534963",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7c3324f08b21445fb00f1e8eaa26283f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46581",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:10:25.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33778
Vulnerability from cvelistv5
Published
2023-06-01 00:00
Modified
2025-01-09 17:24
Severity ?
EPSS score ?
Summary
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:06.496Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-33778",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T17:24:27.672008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T17:24:35.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-01T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33778",
"datePublished": "2023-06-01T00:00:00",
"dateReserved": "2023-05-22T00:00:00",
"dateUpdated": "2025-01-09T17:24:35.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46564
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:23
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46564",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:37.209120Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:23:13.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:56.158234",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#4ebd20d478124581b01338b89622363a"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46564",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:23:13.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46597
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:05
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:04:58.859031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:05:58.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:29.087674",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#11467dddc16f460db85a5e8d3a6665fb"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46597",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:05:58.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46598
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:05
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:04:57.534943Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:05:46.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:30.964175",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#0875f261ad5c4e1ba59448d49a261a99"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46598",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:05:46.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46584
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:09
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:16.804696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:09:29.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:13.560115",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#20fb6e1bcec049728e6319d9da46416d"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46584",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:09:29.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46554
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:24
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46554",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:48.293609Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:24:41.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:17.256517",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#ee86534f23b84f2cbfa9401ee1d9d179"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46554",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:24:41.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46559
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:23
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46559",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:40.856935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:23:43.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:28.698458",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#acee48e159494c479aecc1bfa87f0d83"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46559",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:23:43.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46551
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:25
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:52.467941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:25:15.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:14.074563",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#aabdeced2a5e407ba3b3c0d318af0a29"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46551",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:25:15.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46588
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:08
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46588",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:11.991193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:08:29.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:18.964809",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7be91fa3afab4c9c978f7f6c1cc4c847"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46588",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:08:29.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46580
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:10
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:21.606182Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:10:44.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:07.845364",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#230c640b5e354e20b5b529a510079eea"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46580",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:10:44.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46586
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:08
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:13.947467Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:08:53.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:16.354986",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#3d4d22d30d164ef9b8fb1fe1024ada3a"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46586",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:08:53.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46596
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:06
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:00.305127Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:06:22.307Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:28.581544",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#d049794ac4804e48968cb77589d5ec45"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46596",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:06:22.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46560
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:23
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:39.642324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:23:35.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:53.807876",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#2a9a497ab8214aeb991df9b9714b3c25"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46560",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:23:35.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46582
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:10
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:19.264309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:10:05.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:11.544602",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#20001f379c5641a1ab4f7ce459ce3db0"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46582",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:10:05.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46571
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:16
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46571",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:31.115364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:16:37.298Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:05.198325",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#b325c78d0d4643b6a2e7703a811f1dd5"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46571",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:16:37.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-41587
Vulnerability from cvelistv5
Published
2024-10-03 00:00
Modified
2024-10-03 20:25
Severity ?
EPSS score ?
Summary
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41587",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-03T20:24:15.931214Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T20:25:36.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T18:25:02.832324",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-41587",
"datePublished": "2024-10-03T00:00:00",
"dateReserved": "2024-07-18T00:00:00",
"dateUpdated": "2024-10-03T20:25:36.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46552
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:25
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:51.159208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:25:00.328Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:15.143030",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#53ad238cc1af41f7a32b29260f7274ec"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46552",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:25:00.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-41594
Vulnerability from cvelistv5
Published
2024-10-03 00:00
Modified
2024-10-03 19:09
Severity ?
EPSS score ?
Summary
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41594",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-03T19:09:26.192252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T19:09:40.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T18:29:39.340103",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-41594",
"datePublished": "2024-10-03T00:00:00",
"dateReserved": "2024-07-18T00:00:00",
"dateUpdated": "2024-10-03T19:09:40.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46591
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:07
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:07.863065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:07:39.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:21.928984",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#336655c8396248a2b0fc7be9da0b64c9"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46591",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:07:39.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46566
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:22
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46566",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:34.725516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:22:54.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:58.085968",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#fed8e44f6b1e44fa9432a8359c36906a"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46566",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:22:54.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46556
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:24
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:45.697185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:24:16.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:22.168624",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#a26d36d8c8d042299348d8ec7a0260ca"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46556",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:24:16.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46568
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:22
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46568",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:32.265576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:22:34.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:00.191524",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#41a3e5586f424ceb858a5a66836a40cb"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46568",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:22:34.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-41591
Vulnerability from cvelistv5
Published
2024-10-03 00:00
Modified
2024-10-03 19:14
Severity ?
EPSS score ?
Summary
DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-03T19:14:46.529762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T19:14:57.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T18:26:22.678110",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-41591",
"datePublished": "2024-10-03T00:00:00",
"dateReserved": "2024-07-18T00:00:00",
"dateUpdated": "2024-10-03T19:14:57.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46565
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:23
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:35.931168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:23:03.960Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:56.963234",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#34ffb536a14f400680eec54e565b25f3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46565",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:23:03.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46567
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:25
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46567",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:33.495835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:25:54.021Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:59.053834",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#c17358f2569248cea5c2b6c1bfe94306"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46567",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:25:54.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46561
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:23
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46561",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:38.528344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:23:25.271Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:55.054293",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#48ac749c7e444d8398b414f9d1d48c40"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46561",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:23:25.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46583
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:09
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:18.061660Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:09:46.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:12.352206",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#0f15f2bf2eb448c381255850e43cf96a"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46583",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:09:46.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-32548
Vulnerability from cvelistv5
Published
2022-08-29 05:38
Modified
2024-08-03 07:46
Severity ?
EPSS score ?
Summary
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:46:43.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-29T05:38:35",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-32548",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers",
"refsource": "MISC",
"url": "https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers"
},
{
"name": "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html",
"refsource": "MISC",
"url": "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-32548",
"datePublished": "2022-08-29T05:38:35",
"dateReserved": "2022-06-08T00:00:00",
"dateUpdated": "2024-08-03T07:46:43.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46592
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:07
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:06.401601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:07:23.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:27.031879",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1fe94a7181d24f5fbe464a5f9417d084"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46592",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:07:23.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46550
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:25
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:15:53.560810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:25:29.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:41:09.960721",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#bffdd8897d944a77834b865d9326a1d7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46550",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:25:29.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-46585
Vulnerability from cvelistv5
Published
2024-09-18 00:00
Modified
2024-09-18 16:09
Severity ?
EPSS score ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:05:15.677076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:09:12.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T14:42:14.797492",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#8defec5c93be4cdfa5a1ea1078cbe7d2"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46585",
"datePublished": "2024-09-18T00:00:00",
"dateReserved": "2024-09-11T00:00:00",
"dateUpdated": "2024-09-18T16:09:12.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
var-202410-0179
Vulnerability from variot
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL. vigor2620 firmware, vigor2915 firmware, vigor2866 firmware etc. DrayTek Corporation The product contains a cryptographic strength vulnerability.Information may be obtained
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202410-0179",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor2866",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor3912",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.6.1"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2832",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2860",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor165",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor2925",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2763",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2915",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigorlte200",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2926",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3220",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2135",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2952",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2762",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2865",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor2962",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2765",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2620",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2766",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor2862",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3910",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor166",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2133",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor1000b",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2766",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2866",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2765",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2865",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor165",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2962",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2133",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2762",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigorlte200",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor1000b",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2915",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3912",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2620",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2763",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2135",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor166",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"cve": "CVE-2024-41594",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2024-41594",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2024-41594",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-41594",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-41594",
"trust": 0.8,
"value": "High"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL. vigor2620 firmware, vigor2915 firmware, vigor2866 firmware etc. DrayTek Corporation The product contains a cryptographic strength vulnerability.Information may be obtained",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-41594"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-41594",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009984",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"id": "VAR-202410-0179",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6666667
},
"last_update_date": "2024-10-10T23:21:46.664000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-326",
"trust": 1.0
},
{
"problemtype": "Inappropriate cryptographic strength (CWE-326) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"trust": 1.0,
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-41594"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"date": "2024-10-03T19:15:04.800000",
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T01:14:00",
"db": "JVNDB",
"id": "JVNDB-2024-009984"
},
{
"date": "2024-10-08T15:31:47.907000",
"db": "NVD",
"id": "CVE-2024-41594"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0DrayTek\u00a0Corporation\u00a0 Vulnerability related to encryption strength in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009984"
}
],
"trust": 0.8
}
}
var-202306-0072
Vulnerability from variot
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-0072",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor167",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2620l",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862lac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2832n",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorlte 200n",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorswitch p2100",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigorap 960c",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigor2865ax",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862ln",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorswitch g1080",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2765ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2862n",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2926 plus",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorap 918r",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigor2927f",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2865vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866ax",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2765ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2865l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2766ax",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2766vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2135ax",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2620l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2865ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2766ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2865vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorap 903",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigor2765ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2135vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2927lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2865ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2620ln",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2915ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862bn",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor165",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2763ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2927f",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2135fvac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorap 1000c",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2927ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2865ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor166",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2766ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2865lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2765vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor130",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2866lac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2862bn",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor165",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorswitch g2121",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2927f",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2915ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorlte 200n",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorswitch p2540xs",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor3910",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2927ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor167",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2927vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor166",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigorswitch p1282",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "myvigor",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.3.2"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2865lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862ln",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2765ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862n",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2766vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorswitch g1085",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2866ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2865l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigorswitch g2280x",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2926 plus",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2866ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2862l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2763ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2135ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2620l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigorap 1060c",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigor2915ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2832n",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorlte 200n",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862ln",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2765ax",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorap 912c",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigorswitch g2540xs",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor1000b",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor166",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2927ax",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2927lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2865ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2620ln",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2866l",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorswitch pq2121x",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2763ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigorswitch fx2120",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2766vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2135fvac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2865l",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorswitch pq2200xb",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2866ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor130",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927lac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorswitch q2121x",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2765vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2865vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2765ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2620ln",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigorswitch q2200x",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2866l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2927l",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2766ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135fvac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2866lac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2862ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2962",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862b",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2862l",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorswitch g2100",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2927l",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor130",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor167",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2765vac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862ac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2832n",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2862bn",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor165",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2135vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2865lac",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigorswitch p2280x",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2862n",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.0.0"
},
{
"model": "vigor2866vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigorap 906",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "1.4.0"
},
{
"model": "vigor2866ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigorswitch g1282",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "2.6.7"
},
{
"model": "vigor2766ax",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2862vac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2926 plus",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "3.9.6"
},
{
"model": "vigor2865ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
},
{
"model": "vigor2766ac",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.4"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"cve": "CVE-2023-33778",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2023-33778",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-33778",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-003",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
},
{
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-33778"
},
{
"db": "VULMON",
"id": "CVE-2023-33778"
}
],
"trust": 0.99
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-33778",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-202306-003",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-33778",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-33778"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
},
{
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"id": "VAR-202306-0072",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-08-14T15:05:37.549000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://gist.github.com/ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-33778/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-33778"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
},
{
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-33778"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
},
{
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-01T00:00:00",
"db": "VULMON",
"id": "CVE-2023-33778"
},
{
"date": "2023-06-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-003"
},
{
"date": "2023-06-01T04:15:10.313000",
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-06-01T00:00:00",
"db": "VULMON",
"id": "CVE-2023-33778"
},
{
"date": "2023-06-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-003"
},
{
"date": "2023-06-09T18:26:41.557000",
"db": "NVD",
"id": "CVE-2023-33778"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor Routers Trust Management Issue Vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-003"
}
],
"trust": 0.6
}
}
var-202409-1117
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sPubKey parameter of the dialin.cgi page failing to correctly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1117",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"cve": "CVE-2024-46597",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39948",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46597",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46597",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46597",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46597",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39948",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sPubKey parameter of the dialin.cgi page failing to correctly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46597"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "CNVD",
"id": "CNVD-2024-39948"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46597",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39948",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"id": "VAR-202409-1117",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
}
]
},
"last_update_date": "2024-10-10T23:14:12.511000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39948)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598451"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#11467dddc16f460db85a5e8d3a6665fb"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46597"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"date": "2024-09-18T15:15:18.400000",
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39948"
},
{
"date": "2024-09-25T01:19:00",
"db": "JVNDB",
"id": "JVNDB-2024-008820"
},
{
"date": "2024-09-24T16:41:09.457000",
"db": "NVD",
"id": "CVE-2024-46597"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008820"
}
],
"trust": 0.8
}
}
var-202409-1236
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the AControlIp1 parameter of the acontrol.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1236",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"cve": "CVE-2024-46584",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39943",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46584",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46584",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46584",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46584",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39943",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the AControlIp1 parameter of the acontrol.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46584"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "CNVD",
"id": "CNVD-2024-39943"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46584",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39943",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"id": "VAR-202409-1236",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
}
]
},
"last_update_date": "2024-10-10T23:27:52.626000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598426"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#20fb6e1bcec049728e6319d9da46416d"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46584"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"date": "2024-09-18T15:15:17.790000",
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39943"
},
{
"date": "2024-09-25T01:50:00",
"db": "JVNDB",
"id": "JVNDB-2024-008838"
},
{
"date": "2024-09-24T16:40:50.223000",
"db": "NVD",
"id": "CVE-2024-46584"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008838"
}
],
"trust": 0.8
}
}
var-202409-1232
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sPPPSrvNm parameter of the fwuser.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1232",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"cve": "CVE-2024-46571",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39950",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46571",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46571",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46571",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46571",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39950",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sPPPSrvNm parameter of the fwuser.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46571"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "CNVD",
"id": "CNVD-2024-39950"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46571",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39950",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"id": "VAR-202409-1232",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
}
]
},
"last_update_date": "2024-10-10T23:19:39.145000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39950)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598461"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#b325c78d0d4643b6a2e7703a811f1dd5"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46571"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"date": "2024-09-18T15:15:17.530000",
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39950"
},
{
"date": "2024-09-25T02:31:00",
"db": "JVNDB",
"id": "JVNDB-2024-008877"
},
{
"date": "2024-09-24T16:42:03.157000",
"db": "NVD",
"id": "CVE-2024-46571"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008877"
}
],
"trust": 0.8
}
}
var-202410-0075
Vulnerability from variot
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6. DrayTek Corporation of vigor3910 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202410-0075",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3912",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.6.1"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor2866",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2832",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2860",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor165",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor2925",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2763",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2915",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigorlte200",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2926",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3220",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2135",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2952",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2762",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2865",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor2962",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2765",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2620",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2766",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor2862",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3910",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor166",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor2133",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor1000b",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.8"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.4.0.0 that\u0027s all 4.4.3.1"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"cve": "CVE-2024-41587",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.3,
"id": "CVE-2024-41587",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.4,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2024-41587",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "Low",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-41587",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2024-41587",
"trust": 0.8,
"value": "Medium"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6. DrayTek Corporation of vigor3910 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-41587"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-41587",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009832",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"id": "VAR-202410-0075",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6666667
},
"last_update_date": "2024-10-08T23:27:00.949000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.0
},
{
"problemtype": "Cross-site scripting (CWE-79) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"trust": 1.0,
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-41587"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"date": "2024-10-03T19:15:04.310000",
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-07T03:05:00",
"db": "JVNDB",
"id": "JVNDB-2024-009832"
},
{
"date": "2024-10-08T15:32:18.313000",
"db": "NVD",
"id": "CVE-2024-41587"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Cross-site scripting vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009832"
}
],
"trust": 0.8
}
}
var-202409-1193
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the extRadSrv2 parameter of the cgiapp.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1193",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"cve": "CVE-2024-46583",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39944",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46583",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46583",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46583",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46583",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39944",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the extRadSrv2 parameter of the cgiapp.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46583"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "CNVD",
"id": "CNVD-2024-39944"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46583",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39944",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"id": "VAR-202409-1193",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
}
]
},
"last_update_date": "2024-10-10T23:22:56.686000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39944)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598431"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#0f15f2bf2eb448c381255850e43cf96a"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46583"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"date": "2024-09-18T15:15:17.723000",
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39944"
},
{
"date": "2024-09-25T06:14:00",
"db": "JVNDB",
"id": "JVNDB-2024-008955"
},
{
"date": "2024-09-24T16:40:48.437000",
"db": "NVD",
"id": "CVE-2024-46583"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008955"
}
],
"trust": 0.8
}
}
var-202409-1080
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the CGIbyFieldName parameter of the chglog.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1080",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"cve": "CVE-2024-46550",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39946",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46550",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46550",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46550",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46550",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39946",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the CGIbyFieldName parameter of the chglog.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46550"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "CNVD",
"id": "CNVD-2024-39946"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46550",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39946",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"id": "VAR-202409-1080",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
}
]
},
"last_update_date": "2024-10-10T23:08:51.435000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39946)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598441"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#bffdd8897d944a77834b865d9326a1d7"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46550"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"date": "2024-09-18T15:15:16.533000",
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39946"
},
{
"date": "2024-09-25T01:50:00",
"db": "JVNDB",
"id": "JVNDB-2024-008842"
},
{
"date": "2024-09-24T16:42:25.057000",
"db": "NVD",
"id": "CVE-2024-46550"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008842"
}
],
"trust": 0.8
}
}
var-202409-1092
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sBPA_Pwd parameter of the inet15.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1092",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"cve": "CVE-2024-46551",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39951",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46551",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46551",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46551",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46551",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39951",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sBPA_Pwd parameter of the inet15.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46551"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "CNVD",
"id": "CNVD-2024-39951"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46551",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39951",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"id": "VAR-202409-1092",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
}
]
},
"last_update_date": "2024-10-10T23:18:31.687000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39951)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598466"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#aabdeced2a5e407ba3b3c0d318af0a29"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46551"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"date": "2024-09-18T15:15:16.590000",
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39951"
},
{
"date": "2024-09-25T01:20:00",
"db": "JVNDB",
"id": "JVNDB-2024-008827"
},
{
"date": "2024-09-24T16:41:38.327000",
"db": "NVD",
"id": "CVE-2024-46551"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008827"
}
],
"trust": 0.8
}
}
var-202410-0281
Vulnerability from variot
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow. vigor3912 firmware, vigor2962 firmware, vigor3910 firmware etc. DrayTek Corporation The product contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202410-0281",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3912",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.6.1"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor2866",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2832",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2860",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor165",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor2925",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2763",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2915",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigorlte200",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2926",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3220",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2135",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2952",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2762",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2865",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor2962",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2765",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2620",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2766",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor2862",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3910",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor166",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor2133",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor1000b",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2766",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2866",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2765",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2865",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor165",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2962",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2133",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2762",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigorlte200",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor1000b",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2915",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3912",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2620",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2763",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2135",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor166",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"cve": "CVE-2024-41593",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2024-41593",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2024-41593",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-41593",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2024-41593",
"trust": 0.8,
"value": "Critical"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow. vigor3912 firmware, vigor2962 firmware, vigor3910 firmware etc. DrayTek Corporation The product contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-41593"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-41593",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009968",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"id": "VAR-202410-0281",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6666667
},
"last_update_date": "2024-10-13T23:21:57.296000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"trust": 1.0,
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-41593"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"date": "2024-10-03T19:15:04.740000",
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:45:00",
"db": "JVNDB",
"id": "JVNDB-2024-009968"
},
{
"date": "2024-10-08T15:35:04.583000",
"db": "NVD",
"id": "CVE-2024-41593"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0DrayTek\u00a0Corporation\u00a0 Out-of-bounds write vulnerabilities in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009968"
}
],
"trust": 0.8
}
}
var-202409-1248
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the iprofileidx parameter of the dialin.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1248",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"cve": "CVE-2024-46598",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39947",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46598",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46598",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46598",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46598",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39947",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the iprofileidx parameter of the dialin.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46598"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "CNVD",
"id": "CNVD-2024-39947"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46598",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39947",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"id": "VAR-202409-1248",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
}
]
},
"last_update_date": "2024-10-10T23:08:51.399000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39947)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598446"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#0875f261ad5c4e1ba59448d49a261a99"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46598"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"date": "2024-09-18T15:15:18.453000",
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39947"
},
{
"date": "2024-09-25T01:53:00",
"db": "JVNDB",
"id": "JVNDB-2024-008858"
},
{
"date": "2024-09-24T16:37:39.833000",
"db": "NVD",
"id": "CVE-2024-46598"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008858"
}
],
"trust": 0.8
}
}
var-202409-1196
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the trapcomm parameter of the cgiswm.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1196",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"cve": "CVE-2024-46593",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39945",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46593",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46593",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46593",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46593",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39945",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the trapcomm parameter of the cgiswm.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46593"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "CNVD",
"id": "CNVD-2024-39945"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46593",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39945",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"id": "VAR-202409-1196",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
}
]
},
"last_update_date": "2024-10-10T23:11:36.596000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39945)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598436"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#f85d41a6875a4853be9a3c457bc81a33"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46593"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"date": "2024-09-18T15:15:18.220000",
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39945"
},
{
"date": "2024-09-25T01:54:00",
"db": "JVNDB",
"id": "JVNDB-2024-008859"
},
{
"date": "2024-09-24T16:41:02.327000",
"db": "NVD",
"id": "CVE-2024-46593"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008859"
}
],
"trust": 0.8
}
}
var-202409-1093
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sProfileName parameter of the fextobj.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1093",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"cve": "CVE-2024-46564",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39949",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46564",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46564",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46564",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46564",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39949",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sProfileName parameter of the fextobj.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46564"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "CNVD",
"id": "CNVD-2024-39949"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46564",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39949",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"id": "VAR-202409-1093",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
}
]
},
"last_update_date": "2024-10-10T23:29:33.889000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39949)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598456"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#4ebd20d478124581b01338b89622363a"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46564"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"date": "2024-09-18T15:15:17.263000",
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39949"
},
{
"date": "2024-09-25T01:19:00",
"db": "JVNDB",
"id": "JVNDB-2024-008825"
},
{
"date": "2024-09-24T16:41:55.907000",
"db": "NVD",
"id": "CVE-2024-46564"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008825"
}
],
"trust": 0.8
}
}
var-202410-0186
Vulnerability from variot
DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS. vigor2620 firmware, vigor2915 firmware, vigor2866 firmware etc. DrayTek Corporation A cross-site scripting vulnerability exists in the product.Information may be obtained and information may be tampered with
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202410-0186",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor2866",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor3912",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.6.1"
},
{
"model": "vigor3910",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2832",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2860",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor165",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor2925",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2763",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2962",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2915",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigorlte200",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2926",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3220",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2135",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2952",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2762",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2865",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.2"
},
{
"model": "vigor2962",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2765",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor2620",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor2766",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.5.3"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.3.1"
},
{
"model": "vigor2862",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor3910",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor166",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.2.7"
},
{
"model": "vigor1000b",
"scope": "lt",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.8"
},
{
"model": "vigor2133",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "*"
},
{
"model": "vigor1000b",
"scope": "gte",
"trust": 1.0,
"vendor": "draytek",
"version": "4.4.0.0"
},
{
"model": "vigor2766",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2866",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2765",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2865",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor165",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2962",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2133",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2762",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigorlte200",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor1000b",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2915",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3912",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2620",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2763",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor2135",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor166",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"cve": "CVE-2024-41591",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2024-41591",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2024-41591",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-41591",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2024-41591",
"trust": 0.8,
"value": "Medium"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS. vigor2620 firmware, vigor2915 firmware, vigor2866 firmware etc. DrayTek Corporation A cross-site scripting vulnerability exists in the product.Information may be obtained and information may be tampered with",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-41591"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-41591",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2024-009985",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"id": "VAR-202410-0186",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6666667
},
"last_update_date": "2024-10-11T23:01:21.952000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.0
},
{
"problemtype": "Cross-site scripting (CWE-79) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"trust": 1.0,
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-41591"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"date": "2024-10-03T19:15:04.560000",
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T01:14:00",
"db": "JVNDB",
"id": "JVNDB-2024-009985"
},
{
"date": "2024-10-08T15:34:46.453000",
"db": "NVD",
"id": "CVE-2024-41591"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0DrayTek\u00a0Corporation\u00a0 Cross-site scripting vulnerability in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-009985"
}
],
"trust": 0.8
}
}
var-202409-1055
Vulnerability from variot
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sBPA_UsrNme parameter of the inet15.cgi page failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202409-1055",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "vigor3910",
"scope": "eq",
"trust": 1.0,
"vendor": "draytek",
"version": "4.3.2.6"
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": null,
"trust": 0.8,
"vendor": "draytek",
"version": null
},
{
"model": "vigor3910",
"scope": "eq",
"trust": 0.8,
"vendor": "draytek",
"version": "vigor3910 firmware 4.3.2.6"
},
{
"model": "vigor",
"scope": "eq",
"trust": 0.6,
"vendor": "draytek",
"version": "3910v4.3.2.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"cve": "CVE-2024-46559",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-39952",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-46559",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2024-46559",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2024-46559",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2024-46559",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-39952",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. DrayTek Corporation of vigor3910 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. DrayTek Vigor 3910 is a high-performance router for enterprise networks from DrayTek, a Chinese company. The vulnerability is caused by the sBPA_UsrNme parameter of the inet15.cgi page failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-46559"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "CNVD",
"id": "CNVD-2024-39952"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-46559",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2024-39952",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"id": "VAR-202409-1055",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
}
],
"trust": 1.4333333000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
}
]
},
"last_update_date": "2024-10-10T23:21:46.790000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for DrayTek Vigor 3910 Buffer Overflow Vulnerability (CNVD-2024-39952)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/598471"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://ink-desk-28f.notion.site/draytek-vigor-3910-analysis-report-b3b23e150c4f4bab822c3c47fd7b9de9#acee48e159494c479aecc1bfa87f0d83"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-46559"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"date": "2024-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"date": "2024-09-18T15:15:17.097000",
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-10-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-39952"
},
{
"date": "2024-09-25T06:07:00",
"db": "JVNDB",
"id": "JVNDB-2024-008948"
},
{
"date": "2024-09-24T16:41:51.380000",
"db": "NVD",
"id": "CVE-2024-46559"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DrayTek\u00a0Corporation\u00a0 of \u00a0vigor3910\u00a0 Classic buffer overflow vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-008948"
}
],
"trust": 0.8
}
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:42
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro CGIbyFieldName en chglog.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46550",
"lastModified": "2024-09-24T16:42:25.057",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.533",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#bffdd8897d944a77834b865d9326a1d7"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sPubKey en dialin.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46597",
"lastModified": "2024-09-24T16:41:09.457",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.400",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#11467dddc16f460db85a5e8d3a6665fb"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sIpv6AiccuUser en inetipv6.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46589",
"lastModified": "2024-09-24T16:40:56.763",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.007",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e170f53316c740488da5d16f57be1b52"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sProfileName en usergrp.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46585",
"lastModified": "2024-09-24T16:40:52.817",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.847",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#8defec5c93be4cdfa5a1ea1078cbe7d2"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro profname en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46554",
"lastModified": "2024-09-24T16:41:42.943",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.783",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#ee86534f23b84f2cbfa9401ee1d9d179"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sDnsPro en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46591",
"lastModified": "2024-09-24T16:40:58.790",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.117",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#336655c8396248a2b0fc7be9da0b64c9"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-10-10 13:14
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro ssidencrypt%d en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46590",
"lastModified": "2024-10-10T13:14:14.267",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.067",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e0a960e24de649b3a67c21a63592d82f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-10-03 19:15
Modified
2024-10-08 15:35
Severity ?
Summary
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.forescout.com/resources/draybreak-draytek-research/ | Mitigation, Technical Description, Third Party Advisory | |
| cve@mitre.org | https://www.forescout.com/resources/draytek14-vulnerabilities | Broken Link |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3912_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "84670562-F228-40A0-A38D-144EA62556D3",
"versionEndExcluding": "4.3.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3912:-:*:*:*:*:*:*:*",
"matchCriteriaId": "282E5318-DAA8-4AA2-8E7D-4B8BD9162153",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0549C870-BE10-441A-B07D-0701915E5A9E",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1A9825-E419-4740-996A-5928D207FCB6",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B937F11C-FC86-4D6E-A46B-BA2CA0FFCEF7",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2602941C-255F-4289-9043-D396CC4B3192",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59521C99-00BA-4503-823E-3FEA44F8DDA0",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CDBC681E-CD03-49E5-BC3A-E4A7654975A3",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDC93B5-DC0A-4AA4-A340-382F108AE80B",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "08B9436B-B2FE-4644-BB06-B0537EC23A71",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AB3320-27F8-4359-AEF8-6B1FDBA67111",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEDC8A7F-08CF-44D2-A9A5-A1353AF35B45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2763_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A559F44-80F8-44B7-B70F-BA0B78C85283",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2763:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA9DF5D-6651-455A-9305-C42C0FF51F01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B1826F9-0258-44DD-A471-113CF55CE563",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60657812-D3A8-4B1B-B7BE-F629991CB053",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3D46DEC-06AB-489F-A0B5-10C31F80A8C1",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865:-:*:*:*:*:*:*:*",
"matchCriteriaId": "871448C6-9183-4828-A287-05F5EC6A44F6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F87D851-15BC-4FC1-8AB7-D5C15B2B74F0",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0AB3C84-67CA-4531-85FB-1A56F3C93ABF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89461FD4-897D-44F1-8486-4BCCDE3772DD",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D0D2760-739F-4C79-AEDC-8B2CCCA2FF53",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6E55BCE-BBF0-454B-AE86-45B7298888B3",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5860CBE4-328E-418D-9E81-1D3AF7DB8F2B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "289E3E0B-6BA4-44B8-968A-AC374B15B631",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D98663B-F2F5-4ADC-9FD5-75846890EEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte200_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BD8E59-6C67-4C80-B25F-2C5814A8CF0E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBF2015-9315-44C8-A9FE-E86146F1958E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43265128-7E8E-4FE2-8488-AC5734A4AF70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1878E59C-FB40-435D-940A-8952C56FA88B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52F71B18-89B5-42C7-B4B7-448844D6AFBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3873B2B9-95C1-4F00-9165-7C4D2A90CDE5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A96F64C0-09DD-4553-AC5F-D722B8321B0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0978465-D59F-4C0A-A29F-5D7BE58BA557",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C4077B-C73F-4431-9103-C09960E203E1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:*",
"matchCriteriaId": "266C73DE-BFC6-4F3E-B022-559B3971CA44",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9D081E5D-7A68-47A0-9EFE-1FC01DA2FF23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B01EDAE-BB9E-4431-BE8C-6505BA7CA42D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2925_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C470B04-BD57-429B-80FC-328A7D2E35E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2925:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7536B29C-2030-4331-B8BF-D269D86D199B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A688631-4B36-43CC-AEF8-D390081F01DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF1B117B-603D-493C-A804-C18ED332A221",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E207BB52-29F8-4F2F-AA06-855B38E22958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952:-:*:*:*:*:*:*:*",
"matchCriteriaId": "167336E2-AAA8-4424-AB07-2D7C9E1542B3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3220_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8437FD-65E2-4203-82B9-8FC32444204A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64955940-3998-4B76-92D1-D9F3FAB874B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow."
},
{
"lang": "es",
"value": "Los dispositivos DrayTek Vigor310 hasta 4.3.2.6 permiten a un atacante remoto ejecutar c\u00f3digo arbitrario a trav\u00e9s de la funci\u00f3n ft_payload_dns(), porque se produce una operaci\u00f3n de extensi\u00f3n de signo de byte para el argumento de longitud de una llamada _memcpy, lo que lleva a un desbordamiento de b\u00fafer basado en el mont\u00f3n."
}
],
"id": "CVE-2024-41593",
"lastModified": "2024-10-08T15:35:04.583",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-10-03T19:15:04.740",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:42
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sPPPSrvNm en fwuser.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46571",
"lastModified": "2024-09-24T16:42:03.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.530",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#b325c78d0d4643b6a2e7703a811f1dd5"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-06-01 04:15
Modified
2025-01-09 18:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef | Exploit, Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:draytek:myvigor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FB9A5891-1058-42FE-8D36-987E967D5481",
"versionEndExcluding": "2.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_pq2200xb_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BCB0DEE3-60C3-49F8-9A6C-47826AFF388D",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_pq2200xb:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A822A86-C784-4AED-B367-4D39609D93E7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_pq2121x_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "35B88F62-BC7C-47AA-80F3-3BEDB0D5E5EA",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_pq2121x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DB7AFBE0-9E98-4B46-9517-B73509F5944D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_p2540xs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA6D7E6-EAD4-45E6-A1CB-4E5CF2543564",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_p2540xs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77DCACA0-BA44-4691-BAAD-828C54898FBB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_p2280x_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D6F173D-4339-4842-AC62-5E4C488D6067",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_p2280x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE6602CA-744E-4543-9818-75FC57E83280",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_p2100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DAB8B117-8605-4C4E-990E-7DE09DF79738",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_p2100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE4BB0C-0419-4A24-9C79-4642DBF22A9F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_q2200x_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F0604938-0253-466F-914D-300590C82AB1",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_q2200x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AC2E8256-45B6-4CDC-A2A8-60303773F149",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_q2121x_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1BABC689-A27B-43C3-B402-2CFF1AFF0012",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_q2121x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19676250-FC97-4476-9A26-304DC8E4B872",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g2540xs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF46332-4269-48FE-8D27-F0642FD08A75",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g2540xs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBFCBF8D-3FCA-4B17-9337-4BD621372F23",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g2280x_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A90A385E-F817-42D4-BB1B-AF37DE3C9491",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g2280x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3586D962-114E-4CD4-B6D2-8B031BBB01B1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g2121_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1C04F98D-5668-4398-8D8B-4CE9340F20A1",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g2121:-:*:*:*:*:*:*:*",
"matchCriteriaId": "25451714-5AE6-43C7-B1CC-A2ED2486E402",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g2100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F86A2C16-44BF-4C7F-A8C5-B03CEBC88CE8",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g2100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8724DACC-85AC-4047-8960-27FCF58C5BF9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_fx2120_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D70A4480-2C9E-4662-8612-23F66A649BA7",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_fx2120:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8F9B1A57-A45D-4EA3-B76B-C0F6FEB92316",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_p1282_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0983154F-C4BC-413F-B020-085E83D5BB44",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_p1282:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65373D8B-0DA8-4539-9E63-DBBDF493508E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g1282_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "632A1555-3550-456B-8ED8-49E5929CE38E",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g1282:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8110E6A8-E30A-4D4B-9210-0FE5F9C0F27C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g1085_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F580E9-2A0E-47E9-9C4B-2B971376C7EC",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g1085:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B61C56D2-6A25-4AF5-95E3-2AFE3E4A33F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorswitch_g1080_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0B400A32-0E46-4AAC-930F-D73A639C85DA",
"versionEndExcluding": "2.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorswitch_g1080:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2498876A-CDF4-423A-93C1-7337231D25E2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0C9BD0C4-5E5F-4E86-89F8-15821EC9618F",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_903:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D793F78F-1A6C-47AC-9F17-877DA0C6DD7D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "13FEC077-B0A0-4F87-A113-D0131946C358",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_912c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F2052075-C2C4-4462-96B7-E3C448B81AD7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "05A02352-B3C3-4A92-822B-9B458CB03EAC",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_918r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "257B6270-8551-4E08-8A04-E8D575407EE0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5783487-C7E1-4E14-B37F-EB4E5A68669B",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_1060c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E73D31F1-2CAA-4837-BC3D-FD4160873334",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5873909E-F741-4139-A29A-DF8D79CA330D",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_906:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8015A1DA-A1B4-4EBC-98AC-941583EF8E37",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79C369C7-16EA-42CC-9E96-9D868977B632",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_960c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D0A4172-5FC4-4925-8BDD-A903FC31AFA6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorap_1000c_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E379F3EF-6789-4897-9B33-EAB954114571",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorap_1000c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E93E754E-F8F5-4E77-8ED1-BFA34C26C2F1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "11182C9F-B2A1-4AE2-9983-6AC3DB8DE372",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2766ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "10586770-1426-435D-8137-2486A2843219",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "787134FE-0549-427D-A9CE-32B1C58BC954",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8919EE4B-349B-435A-8E9C-A4C24504AF02",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2766ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C23468E0-F84F-4FAD-8CA0-0A66E0C3D5C0",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4B3D0E87-A5A2-4828-A79D-DB10FE6BC4D2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7DF64120-5611-41D1-ADC0-2C8F4522A205",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2766vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFC418D6-76FF-4208-B649-9650E572B750",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "228DC583-B6BC-4948-A167-53C49B6D04B2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68D1D724-D590-49FE-A301-C493FA4E50C3",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2765ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01E3E66C-815B-4DAE-9A38-DD8C583A4DF5",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F653097B-9197-43A9-A9B4-8AA6EAFC5666",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99D00C6D-2DCA-4737-9652-D576585ED712",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2765vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E8B0DC03-200A-4DE1-93C8-F46698E3C4B0",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7A582D29-85D9-4FC3-B88A-42B947B9D18C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47866545-C9BF-4FCA-ADCA-ED2E44FC4097",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2765ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "076A3429-8E00-419F-96D0-40917CEDC328",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F1B9AF22-089B-41FB-8E30-BED3E4CE32ED",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2763ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CFF9F139-1975-4EE2-93E5-A22A1C9DEEA7",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2763ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "37B22541-27CF-488D-A35B-6E8EB3FD1958",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2763ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC9BF014-B8EA-4DD9-8320-627C3D276596",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BADF0105-D4FF-4F9C-A45F-86A1D29F0AF0",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2620l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F4290ACF-3E73-4C09-9001-6A2AC31BF719",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DD1E5ED-6A96-4C4A-87D4-692988479D01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83DA643A-7804-4058-963B-D4F9EF48D368",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2620ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6DCA1285-F9C7-4F21-BA80-09EE9FD2BC61",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620ln:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B71980-6D7A-4B7B-9863-E85CC849ED90",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte_200n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "67ABDDAF-CFA5-4185-B51C-8694FCF5ECAE",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigorlte_200n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "743D7983-774E-43A2-8D9E-FD7ECFF49208",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte_200n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00DC816E-1840-46F0-97C4-2BA00F5B9E64",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8FD7B44A-0421-471B-B777-2E1E4B6BC9E6",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2915ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "05E71AD2-9353-48A0-8C5E-8CB0501E6CDF",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4318B8A-B94C-4207-9731-76D35DE85034",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A7C5B846-1076-498A-9B18-E3AB9CA71664",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2135ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D23AC0A0-B4D4-4405-BA85-D3CEDC99254C",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77D227B7-1121-4657-A621-AF0C0E766D90",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D054B8D0-4B1E-4A04-A268-B9F5B2494E2A",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2135ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5FBDE83D-0DC2-4265-8C13-6D67B8E551FB",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C37EA55-2526-4130-A57C-65950A5DFE57",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135fvac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6678CEE9-D55E-4BEB-9684-9E6A1275D7DA",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2135fvac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2933150F-1ACD-4CBB-AF76-52B0EF30D314",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135fvac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "625DE418-F506-4579-9C25-04DCD0FBC7ED",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "626A6BF5-0EA2-4B69-9FF9-95963A7BDC2E",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2135vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C24391FB-6E97-485C-A09E-BDEB991554A8",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AAC1C9BE-31B5-47DD-BE09-0984EE29A957",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE309C25-7405-43CA-84D9-D026995A2C1B",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2866ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5A4727DF-9C6B-451F-B0D8-97771723DB79",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F84DE3D-5FFD-4D6F-877A-A656287BDD7B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7BC57D4-992C-4A15-9E0B-4A92DAB0E8FF",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2866ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E09C70BB-0404-44D2-BCA5-1A1ACF96DC81",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1E82803D-B1DE-4541-913C-9128B313AC0E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43F53028-CD42-4B00-8E47-6E04ECCD7DB9",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2866vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1726990C-A56E-4FA3-A274-0059796DBD5D",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5295B4DF-DE6C-4725-A22B-1186D5AB1325",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "37EF7FFF-27D8-493F-AC08-CA08D8C68B9B",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2866l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45D29250-F220-473C-B50D-CBEBCFF2FACC",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "315CA850-DA5C-46E8-90A1-457320A52AA3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE4D0323-BBDE-4770-956C-343C44C0963B",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2866lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C7A64C0-9FEF-4B90-B938-80B23AE31172",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4504923B-C903-432D-B4D2-287BD0145F3B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "27BC97E5-6000-4BB0-990A-63CC9EB7B464",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2865ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52037B3F-4CAA-4FF2-894F-D4C4F6F6EF34",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B2D62A63-1E53-469C-B06C-DB6D05C7BE2F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0ECC2E3B-9D0A-4599-B183-A8D13486A07E",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2865ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "662A9E6F-8D9E-4332-B3D2-5B364A7AEAB4",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "699735FA-D33E-4F32-9584-B15938FB954E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CA84174C-4735-41D7-AED6-4628A00506CD",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2865vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "451A5CEC-8FE1-49AB-B196-BA644E6C6052",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C40B478-C28F-430A-A690-5EF9FFB4812E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "70A64A15-79FD-4C33-B0A2-6B5AB22E0A10",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2865l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D0F60FE9-4C8C-4987-BA4D-A013565C0276",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4F462E8-6427-4E42-902B-07E8A9366423",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D930CFA9-2991-42D9-B34F-A33ECD1EB5A6",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2865lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9DCDD22F-A2FE-4A33-B577-E54434BCA715",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B87FA44-4931-4DC4-89BE-72A591C7C355",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4000DB83-9F7E-4CF2-8BE4-620518BAE9B5",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B2F06ECA-134C-4C77-B347-17FCACB23AF1",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DF8ECCA-405E-4D60-92ED-7F29F36A985F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04D0B7F9-91E5-4C11-9E60-BEEFFA94A04A",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "409F0831-39FC-406B-9F40-1A819D94E638",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB77A5C7-026C-4172-970A-28E0D1A6F2D1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "60C59833-B82E-411B-8538-EABFE4F14E3A",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45BFE7A0-2AFE-47E9-B383-E4A46DEF8418",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB96DDC-9961-47D4-81DF-4117A1B9C8F1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "81CF6DA5-1686-46B9-910D-A94DD63F08DC",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5F7C2B-C1BC-4E9A-99D0-F89F47EC597B",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DC7469CB-2CDE-4D2D-988A-13A482A59B28",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862bn_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "29C38D34-5902-469F-BA3D-2C4F8D8A3CC6",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862bn_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "153F7DFA-1B02-4DFB-8E1E-B651BD09F900",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862bn:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60F97B4A-B323-4354-9CAC-60BCB02A44DE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D42814F5-C33D-43DF-A1B9-A993F7D65881",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "36C33DCB-487D-4CB4-A4C0-2C4B510AF422",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "96B57263-4900-4F2E-AA5C-554B5163F489",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "650DC374-F23A-4FE1-9AA4-CC55DD5B88A0",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04F1AD94-F4F4-467A-A48F-AA4FD46D0191",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6A89BEEB-3F13-4C41-9133-788232DD229B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "05478558-3571-47B6-865A-51C382710FFA",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2862ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78546B3A-97EB-4700-85EB-04CBED086A1C",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862ln:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1D1ADB5D-D2CF-464B-9F1C-45F31A032953",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6B44F218-4547-4011-B6DB-575CF501A872",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2832n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F85CD06-04CC-4A4E-A279-D110D966FAAF",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B22E55C6-F71F-4EA7-B679-895A012B7020",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1330489C-DFC4-4403-B656-E4CFFF0101E8",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2927ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "534F07F3-622A-4756-9C51-5403C12AA0D6",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C188F12-157F-4B8C-9A66-678B933E20F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A22DC676-E8C6-4422-942E-55EB3535DB68",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2927ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D40DA2AE-0AAF-4DEB-8A07-91D7D15F90A4",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B846175B-4DC0-4268-AAF2-F266BFD7646E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6F5DC1B3-BB98-4178-AD67-FE3D3481D2CD",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2927vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "34386461-6500-4653-BF1B-5E5299D0E662",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD217200-9848-425F-B113-E624C027BC9C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927f_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "150F7911-3FB3-429B-8974-7CD3D08A2109",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2927f_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "23A09F00-EBA9-4D82-8CC6-99C36095EFB4",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927f:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD5CF335-A5C0-46CC-A56C-0DBE15D01F0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2D036F0-BF3A-43D1-AAF0-1F88F51FD58D",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2927l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ADE56943-366C-4D0E-8367-1E63C104F1D7",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EC9D70E8-080B-4F0E-BA3A-ACFE8F61475B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B635143B-5C87-4A26-8E99-80D1061586C2",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2927lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9217655B-2A6A-457B-A72A-240DABD72ED8",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5ABFF7-F5DA-485F-976B-5C858B85E994",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_plus_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9AA22E6-35C2-4D7D-8521-315F1CF617E6",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2926_plus_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1513AAB7-E518-4E71-A2C8-D677677F7284",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926_plus:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AAC3E2A0-797D-4512-98A5-4ACE48EF4225",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "523910EF-FEFF-410B-8256-C7C0CE39649F",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56E46B5A-D2B2-4ACA-B959-87B24CEAF5CA",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5E7F61CB-714A-4855-AB07-7281E05D7F72",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FDE33FDF-EABE-4A61-97B1-B12F5A2D0F1A",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "26E65A66-EEC8-42B7-9787-F55339B70EBE",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E971141F-469A-499D-8F2A-20F8999240DC",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58FF72CC-49AB-4D1F-A972-FC98DCDDCF2B",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C66404FA-6FCE-43B7-8F3C-177FB740C39E",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "334E4F8A-B695-46A1-8362-4B97FE5CD424",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4B649FFA-6D64-42A1-80A9-9B590EA8F5E3",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor130_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F167623-480E-49F3-869C-4CFD897AF696",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor130_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0BB13341-7544-4459-B29F-D0F9BEE3001E",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7194998-2D96-43DE-85B6-35A8E474C695",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor167_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "23AEEDBE-5556-4358-A955-C4F30D969642",
"versionEndExcluding": "3.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor167_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FA97EBDF-8908-462A-807A-CDBA15AD5952",
"versionEndExcluding": "4.2.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor167:-:*:*:*:*:*:*:*",
"matchCriteriaId": "71A66A89-CF31-4C63-9562-707C03117104",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website."
}
],
"id": "CVE-2023-33778",
"lastModified": "2025-01-09T18:15:26.790",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-06-01T04:15:10.313",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sSrvAddr en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46582",
"lastModified": "2024-09-24T16:41:29.377",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.680",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#20001f379c5641a1ab4f7ce459ce3db0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro pub_key en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46560",
"lastModified": "2024-09-24T16:41:52.840",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.160",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#2a9a497ab8214aeb991df9b9714b3c25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-10-03 19:15
Modified
2024-10-08 15:32
Severity ?
Summary
Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.forescout.com/resources/draybreak-draytek-research/ | Mitigation, Technical Description, Third Party Advisory | |
| cve@mitre.org | https://www.forescout.com/resources/draytek14-vulnerabilities | Broken Link |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B937F11C-FC86-4D6E-A46B-BA2CA0FFCEF7",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2602941C-255F-4289-9043-D396CC4B3192",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3912_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "84670562-F228-40A0-A38D-144EA62556D3",
"versionEndExcluding": "4.3.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3912:-:*:*:*:*:*:*:*",
"matchCriteriaId": "282E5318-DAA8-4AA2-8E7D-4B8BD9162153",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0549C870-BE10-441A-B07D-0701915E5A9E",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1A9825-E419-4740-996A-5928D207FCB6",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59521C99-00BA-4503-823E-3FEA44F8DDA0",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CDBC681E-CD03-49E5-BC3A-E4A7654975A3",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDC93B5-DC0A-4AA4-A340-382F108AE80B",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "08B9436B-B2FE-4644-BB06-B0537EC23A71",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AB3320-27F8-4359-AEF8-6B1FDBA67111",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEDC8A7F-08CF-44D2-A9A5-A1353AF35B45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2763_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A559F44-80F8-44B7-B70F-BA0B78C85283",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2763:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA9DF5D-6651-455A-9305-C42C0FF51F01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B1826F9-0258-44DD-A471-113CF55CE563",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60657812-D3A8-4B1B-B7BE-F629991CB053",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3D46DEC-06AB-489F-A0B5-10C31F80A8C1",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865:-:*:*:*:*:*:*:*",
"matchCriteriaId": "871448C6-9183-4828-A287-05F5EC6A44F6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F87D851-15BC-4FC1-8AB7-D5C15B2B74F0",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0AB3C84-67CA-4531-85FB-1A56F3C93ABF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89461FD4-897D-44F1-8486-4BCCDE3772DD",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D0D2760-739F-4C79-AEDC-8B2CCCA2FF53",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6E55BCE-BBF0-454B-AE86-45B7298888B3",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5860CBE4-328E-418D-9E81-1D3AF7DB8F2B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "289E3E0B-6BA4-44B8-968A-AC374B15B631",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D98663B-F2F5-4ADC-9FD5-75846890EEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte200_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BD8E59-6C67-4C80-B25F-2C5814A8CF0E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBF2015-9315-44C8-A9FE-E86146F1958E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43265128-7E8E-4FE2-8488-AC5734A4AF70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1878E59C-FB40-435D-940A-8952C56FA88B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52F71B18-89B5-42C7-B4B7-448844D6AFBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3873B2B9-95C1-4F00-9165-7C4D2A90CDE5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A96F64C0-09DD-4553-AC5F-D722B8321B0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0978465-D59F-4C0A-A29F-5D7BE58BA557",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C4077B-C73F-4431-9103-C09960E203E1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:*",
"matchCriteriaId": "266C73DE-BFC6-4F3E-B022-559B3971CA44",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9D081E5D-7A68-47A0-9EFE-1FC01DA2FF23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B01EDAE-BB9E-4431-BE8C-6505BA7CA42D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2925_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C470B04-BD57-429B-80FC-328A7D2E35E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2925:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7536B29C-2030-4331-B8BF-D269D86D199B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A688631-4B36-43CC-AEF8-D390081F01DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF1B117B-603D-493C-A804-C18ED332A221",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E207BB52-29F8-4F2F-AA06-855B38E22958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952:-:*:*:*:*:*:*:*",
"matchCriteriaId": "167336E2-AAA8-4424-AB07-2D7C9E1542B3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3220_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8437FD-65E2-4203-82B9-8FC32444204A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64955940-3998-4B76-92D1-D9F3FAB874B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6."
},
{
"lang": "es",
"value": "El XSS almacenado, por parte de usuarios autenticados, es causado por una mala desinfecci\u00f3n del mensaje de saludo de la p\u00e1gina de inicio de sesi\u00f3n en los dispositivos DrayTek Vigor310 hasta 4.3.2.6."
}
],
"id": "CVE-2024-41587",
"lastModified": "2024-10-08T15:32:18.313",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-10-03T19:15:04.310",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-10-03 19:15
Modified
2024-10-08 15:34
Severity ?
Summary
DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.forescout.com/resources/draybreak-draytek-research/ | Mitigation, Technical Description, Third Party Advisory | |
| cve@mitre.org | https://www.forescout.com/resources/draytek14-vulnerabilities | Broken Link |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "289E3E0B-6BA4-44B8-968A-AC374B15B631",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D98663B-F2F5-4ADC-9FD5-75846890EEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6E55BCE-BBF0-454B-AE86-45B7298888B3",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5860CBE4-328E-418D-9E81-1D3AF7DB8F2B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89461FD4-897D-44F1-8486-4BCCDE3772DD",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D0D2760-739F-4C79-AEDC-8B2CCCA2FF53",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F87D851-15BC-4FC1-8AB7-D5C15B2B74F0",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0AB3C84-67CA-4531-85FB-1A56F3C93ABF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3D46DEC-06AB-489F-A0B5-10C31F80A8C1",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865:-:*:*:*:*:*:*:*",
"matchCriteriaId": "871448C6-9183-4828-A287-05F5EC6A44F6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B1826F9-0258-44DD-A471-113CF55CE563",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60657812-D3A8-4B1B-B7BE-F629991CB053",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2763_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A559F44-80F8-44B7-B70F-BA0B78C85283",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2763:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA9DF5D-6651-455A-9305-C42C0FF51F01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AB3320-27F8-4359-AEF8-6B1FDBA67111",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEDC8A7F-08CF-44D2-A9A5-A1353AF35B45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "08B9436B-B2FE-4644-BB06-B0537EC23A71",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CDBC681E-CD03-49E5-BC3A-E4A7654975A3",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDC93B5-DC0A-4AA4-A340-382F108AE80B",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59521C99-00BA-4503-823E-3FEA44F8DDA0",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B937F11C-FC86-4D6E-A46B-BA2CA0FFCEF7",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2602941C-255F-4289-9043-D396CC4B3192",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0549C870-BE10-441A-B07D-0701915E5A9E",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1A9825-E419-4740-996A-5928D207FCB6",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3912_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "84670562-F228-40A0-A38D-144EA62556D3",
"versionEndExcluding": "4.3.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3912:-:*:*:*:*:*:*:*",
"matchCriteriaId": "282E5318-DAA8-4AA2-8E7D-4B8BD9162153",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte200_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BD8E59-6C67-4C80-B25F-2C5814A8CF0E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBF2015-9315-44C8-A9FE-E86146F1958E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43265128-7E8E-4FE2-8488-AC5734A4AF70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1878E59C-FB40-435D-940A-8952C56FA88B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52F71B18-89B5-42C7-B4B7-448844D6AFBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3873B2B9-95C1-4F00-9165-7C4D2A90CDE5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A96F64C0-09DD-4553-AC5F-D722B8321B0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0978465-D59F-4C0A-A29F-5D7BE58BA557",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C4077B-C73F-4431-9103-C09960E203E1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:*",
"matchCriteriaId": "266C73DE-BFC6-4F3E-B022-559B3971CA44",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9D081E5D-7A68-47A0-9EFE-1FC01DA2FF23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B01EDAE-BB9E-4431-BE8C-6505BA7CA42D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2925_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C470B04-BD57-429B-80FC-328A7D2E35E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2925:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7536B29C-2030-4331-B8BF-D269D86D199B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A688631-4B36-43CC-AEF8-D390081F01DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF1B117B-603D-493C-A804-C18ED332A221",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E207BB52-29F8-4F2F-AA06-855B38E22958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952:-:*:*:*:*:*:*:*",
"matchCriteriaId": "167336E2-AAA8-4424-AB07-2D7C9E1542B3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3220_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8437FD-65E2-4203-82B9-8FC32444204A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64955940-3998-4B76-92D1-D9F3FAB874B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS."
},
{
"lang": "es",
"value": "Los dispositivos DrayTek Vigor3910 hasta 4.3.2.6 permiten XSS reflejado basado en DOM no autenticado."
}
],
"id": "CVE-2024-41591",
"lastModified": "2024-10-08T15:34:46.453",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-10-03T19:15:04.560",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-10-03 19:15
Modified
2024-10-08 15:31
Severity ?
Summary
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.forescout.com/resources/draybreak-draytek-research/ | Mitigation, Technical Description, Third Party Advisory | |
| cve@mitre.org | https://www.forescout.com/resources/draytek14-vulnerabilities | Broken Link |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "289E3E0B-6BA4-44B8-968A-AC374B15B631",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D98663B-F2F5-4ADC-9FD5-75846890EEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6E55BCE-BBF0-454B-AE86-45B7298888B3",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5860CBE4-328E-418D-9E81-1D3AF7DB8F2B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89461FD4-897D-44F1-8486-4BCCDE3772DD",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D0D2760-739F-4C79-AEDC-8B2CCCA2FF53",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F87D851-15BC-4FC1-8AB7-D5C15B2B74F0",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0AB3C84-67CA-4531-85FB-1A56F3C93ABF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3D46DEC-06AB-489F-A0B5-10C31F80A8C1",
"versionEndExcluding": "4.4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865:-:*:*:*:*:*:*:*",
"matchCriteriaId": "871448C6-9183-4828-A287-05F5EC6A44F6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B1826F9-0258-44DD-A471-113CF55CE563",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60657812-D3A8-4B1B-B7BE-F629991CB053",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2763_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A559F44-80F8-44B7-B70F-BA0B78C85283",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2763:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA9DF5D-6651-455A-9305-C42C0FF51F01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AB3320-27F8-4359-AEF8-6B1FDBA67111",
"versionEndExcluding": "4.4.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEDC8A7F-08CF-44D2-A9A5-A1353AF35B45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "08B9436B-B2FE-4644-BB06-B0537EC23A71",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CDBC681E-CD03-49E5-BC3A-E4A7654975A3",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDC93B5-DC0A-4AA4-A340-382F108AE80B",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59521C99-00BA-4503-823E-3FEA44F8DDA0",
"versionEndExcluding": "4.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B937F11C-FC86-4D6E-A46B-BA2CA0FFCEF7",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2602941C-255F-4289-9043-D396CC4B3192",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0549C870-BE10-441A-B07D-0701915E5A9E",
"versionEndExcluding": "4.3.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1A9825-E419-4740-996A-5928D207FCB6",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3912_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "84670562-F228-40A0-A38D-144EA62556D3",
"versionEndExcluding": "4.3.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3912:-:*:*:*:*:*:*:*",
"matchCriteriaId": "282E5318-DAA8-4AA2-8E7D-4B8BD9162153",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte200_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BD8E59-6C67-4C80-B25F-2C5814A8CF0E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBF2015-9315-44C8-A9FE-E86146F1958E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43265128-7E8E-4FE2-8488-AC5734A4AF70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1878E59C-FB40-435D-940A-8952C56FA88B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52F71B18-89B5-42C7-B4B7-448844D6AFBC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3873B2B9-95C1-4F00-9165-7C4D2A90CDE5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A96F64C0-09DD-4553-AC5F-D722B8321B0D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0978465-D59F-4C0A-A29F-5D7BE58BA557",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C4077B-C73F-4431-9103-C09960E203E1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:*",
"matchCriteriaId": "266C73DE-BFC6-4F3E-B022-559B3971CA44",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9D081E5D-7A68-47A0-9EFE-1FC01DA2FF23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B01EDAE-BB9E-4431-BE8C-6505BA7CA42D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2925_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C470B04-BD57-429B-80FC-328A7D2E35E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2925:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7536B29C-2030-4331-B8BF-D269D86D199B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A688631-4B36-43CC-AEF8-D390081F01DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF1B117B-603D-493C-A804-C18ED332A221",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E207BB52-29F8-4F2F-AA06-855B38E22958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952:-:*:*:*:*:*:*:*",
"matchCriteriaId": "167336E2-AAA8-4424-AB07-2D7C9E1542B3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3220_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8437FD-65E2-4203-82B9-8FC32444204A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64955940-3998-4B76-92D1-D9F3FAB874B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL."
},
{
"lang": "es",
"value": "Un problema en los dispositivos DrayTek Vigor310 hasta la versi\u00f3n 4.3.2.6 permite a un atacante obtener informaci\u00f3n confidencial porque el servidor httpd de la interfaz de administraci\u00f3n de Vigor utiliza una cadena est\u00e1tica para inicializar el PRNG de OpenSSL."
}
],
"id": "CVE-2024-41594",
"lastModified": "2024-10-08T15:31:47.907",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-10-03T19:15:04.800",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.forescout.com/resources/draybreak-draytek-research/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-326"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro saveitem en lan2lan.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46595",
"lastModified": "2024-09-24T16:41:05.947",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.307",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7f26d2119de54d5fbc25a8d3ebe2b16c"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:42
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro fid en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46580",
"lastModified": "2024-09-24T16:42:09.207",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.580",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#230c640b5e354e20b5b529a510079eea"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:42
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro iProfileIdx en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46567",
"lastModified": "2024-09-24T16:42:00.340",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.420",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#c17358f2569248cea5c2b6c1bfe94306"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:37
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro iprofileidx en dialin.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46598",
"lastModified": "2024-09-24T16:37:39.833",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.453",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#0875f261ad5c4e1ba59448d49a261a99"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro extRadSrv2 en cgiapp.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46583",
"lastModified": "2024-09-24T16:40:48.437",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.723",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#0f15f2bf2eb448c381255850e43cf96a"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sProfName en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46581",
"lastModified": "2024-09-24T16:41:36.533",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.630",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7c3324f08b21445fb00f1e8eaa26283f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sProfileName en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46557",
"lastModified": "2024-09-24T16:41:48.527",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.983",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#8817e09b31b04ebebdaa5d6df1415df0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sAppName en sslapp.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46566",
"lastModified": "2024-09-24T16:41:58.953",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.367",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#fed8e44f6b1e44fa9432a8359c36906a"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro pb en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46555",
"lastModified": "2024-09-24T16:41:44.893",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.837",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#e15d03bdd4b9441e8eb157fbd09969f4"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sStRtMskShow en ipstrt.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46552",
"lastModified": "2024-09-24T16:41:40.170",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.650",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#53ad238cc1af41f7a32b29260f7274ec"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro trapcomm en cgiswm.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46593",
"lastModified": "2024-09-24T16:41:02.327",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.220",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#f85d41a6875a4853be9a3c457bc81a33"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-08-29 06:15
Modified
2024-11-21 07:06
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html | Exploit, Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B937B768-C53B-490F-B6A8-6B0A2CC6C05A",
"versionEndExcluding": "4.3.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "05E81F44-7E9B-406E-BB4F-A3B6E5B82316",
"versionEndExcluding": "4.3.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "13C4AF21-4B66-4A84-95FB-268F8B644B39",
"versionEndExcluding": "4.3.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962p_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "17AD71DA-3550-4C1F-B2D6-BE8521E8A86C",
"versionEndExcluding": "4.3.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85F44E9E-D6E6-44CB-A724-143EE7D74691",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "411D132F-5340-4EFF-AC02-CF4AAB9320F4",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927:-:*:*:*:*:*:*:*",
"matchCriteriaId": "12460F51-25AB-4EA9-BC43-9CE8DA992D75",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "070AFC36-DFCF-4511-9B72-BCC5E37F5A21",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C188F12-157F-4B8C-9A66-678B933E20F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63F379DA-0262-438F-9689-1D7824257A3A",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B846175B-4DC0-4268-AAF2-F266BFD7646E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1E695FA8-7DC9-483B-89BC-9A55AA69C500",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD217200-9848-425F-B113-E624C027BC9C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BAE83225-B91F-4A39-B3C9-35551B85A61C",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EC9D70E8-080B-4F0E-BA3A-ACFE8F61475B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2927lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3AB34C6-A18C-425F-BC75-E4729FDBA462",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2927lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5ABFF7-F5DA-485F-976B-5C858B85E994",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD74FED6-4AC0-4BB8-A32D-D849350968B0",
"versionEndExcluding": "4.3.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5860CBE4-328E-418D-9E81-1D3AF7DB8F2B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE8DBA39-B28F-4901-860E-DE550A8FADA9",
"versionEndExcluding": "4.3.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4318B8A-B94C-4207-9731-76D35DE85034",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3BC6B8-6B4C-4794-9394-479DF40C7F5A",
"versionEndExcluding": "3.9.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952:-:*:*:*:*:*:*:*",
"matchCriteriaId": "167336E2-AAA8-4424-AB07-2D7C9E1542B3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952p_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CF2DE13B-8494-4E98-B18A-2EA35D9A7650",
"versionEndExcluding": "3.9.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00F421E8-00BE-4451-A948-0D9862E442E3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3220_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0996CFA6-AA5C-4EFD-BD9E-1B0F23F03804",
"versionEndExcluding": "3.9.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64955940-3998-4B76-92D1-D9F3FAB874B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "76E680BF-6C82-4691-92DA-D4F50E4120BB",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF1B117B-603D-493C-A804-C18ED332A221",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "66C1DB0D-3F7F-4EF5-9F23-10AC94B4A439",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C04C85F3-C187-4F82-87A9-ECAF197ABA30",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "957D95D2-3569-4CA0-9C05-279F32B66F44",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65625316-A171-4C06-BFD0-C15A5ACF58A4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "82DF224C-6CE9-43FF-A882-0C3989018D00",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "059842A3-553B-43A0-A714-15C55DA85752",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE43891-7DB2-4C48-97B7-9F1F3051EA7D",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "775E8858-B078-427D-BCB5-6D2B91D17A9D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1498B13D-10BA-49D2-8229-ADFCA5F44B20",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926ln:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9E30F255-ECE9-4E6F-9A22-2826E548C18B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4AB36D6A-658F-4A67-BC7F-045C44A3A322",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4953A99-AD72-4204-BAA9-D87164349E01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "943EEFDB-8958-41BA-84E7-BB28A218B245",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B01EDAE-BB9E-4431-BE8C-6505BA7CA42D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E63AB9A5-C5AE-410E-AFA3-D32F69887D9E",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DF8ECCA-405E-4D60-92ED-7F29F36A985F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C4982251-F1DE-46CF-8995-F9B0CAD4D758",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB77A5C7-026C-4172-970A-28E0D1A6F2D1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0622A4B6-8839-4972-AC2A-1634F4241B9A",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB96DDC-9961-47D4-81DF-4117A1B9C8F1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862b_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "932AA150-DCEE-4313-92E3-B9AECBD6707B",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DC7469CB-2CDE-4D2D-988A-13A482A59B28",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862bn_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A808791A-0863-44F6-8A13-8EFF8EB8C727",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862bn:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60F97B4A-B323-4354-9CAC-60BCB02A44DE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "137281B3-B1F6-4EC4-BB8B-8652533E2337",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "96B57263-4900-4F2E-AA5C-554B5163F489",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF2D8790-A2EE-4AE1-A2DC-CC54108DD263",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862ln:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1D1ADB5D-D2CF-464B-9F1C-45F31A032953",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E5972D23-8225-48C1-B9A5-F63531B548E1",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6A89BEEB-3F13-4C41-9133-788232DD229B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D38C4B52-81DF-40F2-8760-A25915126158",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DD1E5ED-6A96-4C4A-87D4-692988479D01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620ln_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0EDA1B3E-4B46-451B-9462-6BBFF5A16F28",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620ln:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B71980-6D7A-4B7B-9863-E85CC849ED90",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte_200n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99B65954-02D6-4B76-88F2-5787B1A55729",
"versionEndExcluding": "3.9.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte_200n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00DC816E-1840-46F0-97C4-2BA00F5B9E64",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7646BDD0-992E-43D6-A5A9-AB5EA5E89FD3",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1878E59C-FB40-435D-940A-8952C56FA88B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55C8D979-63A8-419F-86CB-CFDBE8C19B2D",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F57E3F-8FFB-4A48-8BFD-5245D1EF2B80",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "03D383A7-C3A8-41E8-8731-04EF97F0CCE1",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "196CE92C-805E-4B6A-8EA8-7A49515FB617",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "297393CA-8855-46DD-A229-D46BA338A57C",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4B81C46C-C837-4C10-AE7F-9E98A1A9E15C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133fvac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56923C0D-7FBF-4110-8220-07D2FFEA30A6",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133fvac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C1999AE2-3E6E-4D18-8FF1-D2A853B5975F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "61F5E418-BA97-4F40-B3E6-AE256FE0EFDD",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3873B2B9-95C1-4F00-9165-7C4D2A90CDE5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762n_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C44183E5-3030-45F1-BE3E-EAA47312E6AB",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "47B532B5-386F-4C4C-8554-C73409124306",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6E41A4B2-4C20-433F-9285-95909A0AEE3B",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CEA5BFB-5D2F-44B2-B995-0675243264CA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "67A1CBE5-09BF-47A6-A6CA-5FF5CEF6670F",
"versionEndExcluding": "3.9.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1F97B07D-BC53-42A4-BBA3-D9CF5D474C9E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71348479-95FE-4E66-A068-74DA89C82F6F",
"versionEndExcluding": "4.2.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFE35F98-0304-415F-B8AF-93C17F8DA6CB",
"versionEndExcluding": "4.2.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C0394013-3F27-4ACA-81C1-17399631DF84",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEDC8A7F-08CF-44D2-A9A5-A1353AF35B45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1355BCF1-FB23-45B9-9201-EA25B2F33920",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77D227B7-1121-4657-A621-AF0C0E766D90",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EBDB62F3-082E-4763-BAA0-69B78DA16B5C",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AAC1C9BE-31B5-47DD-BE09-0984EE29A957",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135fvac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F3327574-E0DB-4CB4-8BDD-C03F09D0974A",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135fvac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "625DE418-F506-4579-9C25-04DCD0FBC7ED",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D431985C-61B3-4124-A363-3124D1AAF5CC",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60657812-D3A8-4B1B-B7BE-F629991CB053",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EEB6111E-2063-4CCF-8E50-4E851264FB16",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F1B9AF22-089B-41FB-8E30-BED3E4CE32ED",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F63944F3-F3D4-4240-819F-15694FB71C1D",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7A582D29-85D9-4FC3-B88A-42B947B9D18C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C34C4A04-A6D0-48F9-BDB0-26847CC0EBAE",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0AB3C84-67CA-4531-85FB-1A56F3C93ABF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CA939906-239F-40DC-B452-8FF64C9907C7",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "787134FE-0549-427D-A9CE-32B1C58BC954",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5E78CBAA-2D96-43C8-84A1-AF6CB42C8131",
"versionEndExcluding": "4.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "228DC583-B6BC-4948-A167-53C49B6D04B2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0928E933-244C-44E7-A7B3-C6009DD12EC2",
"versionEndExcluding": "3.9.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0978465-D59F-4C0A-A29F-5D7BE58BA557",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "98F02BBA-DADE-48C9-8802-6C170714A3DF",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865:-:*:*:*:*:*:*:*",
"matchCriteriaId": "871448C6-9183-4828-A287-05F5EC6A44F6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "57E1D55A-45D7-4427-8BF4-197853948E37",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "699735FA-D33E-4F32-9584-B15938FB954E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF8F3B5B-F074-4AB1-8F2C-D4680A843781",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B2D62A63-1E53-469C-B06C-DB6D05C7BE2F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63B4931B-4B4E-4F30-9A53-657746F3AEEF",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C40B478-C28F-430A-A690-5EF9FFB4812E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6AA4AF52-76AE-4356-94DD-2033D888ED32",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4F462E8-6427-4E42-902B-07E8A9366423",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14488AE9-7FDB-466C-A7BF-3DF43F4A9FE6",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B87FA44-4931-4DC4-89BE-72A591C7C355",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "05E1101F-BFCE-479F-9E3C-932D56E42C9A",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D0D2760-739F-4C79-AEDC-8B2CCCA2FF53",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866ax_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD98A315-7484-442B-A411-CDFCDDDCC625",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866ax:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F84DE3D-5FFD-4D6F-877A-A656287BDD7B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866ac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E30E7C6-C4F5-46C4-87F7-E64AD8CA1DAB",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866ac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1E82803D-B1DE-4541-913C-9128B313AC0E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866vac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51C16598-52C3-4302-B2EF-4714007904D5",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866vac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5295B4DF-DE6C-4725-A22B-1186D5AB1325",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F93460D-E72A-4F55-8471-476BD86B83BD",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "315CA850-DA5C-46E8-90A1-457320A52AA3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866lac_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "962FC4B2-E7AE-4F4F-B6F5-7E71C9EDFFF6",
"versionEndExcluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866lac:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4504923B-C903-432D-B4D2-287BD0145F3B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field."
},
{
"lang": "es",
"value": "Se ha detectado un problema en determinados routers DrayTek Vigor versiones anteriores a julio de 2022, como el Vigor3910 versiones anteriores a 4.3.1.1. El archivo /cgi-bin/wlogin.cgi presenta un desbordamiento de b\u00fafer por medio del nombre de usuario o contrase\u00f1a al campo aa o ab"
}
],
"id": "CVE-2022-32548",
"lastModified": "2024-11-21T07:06:36.290",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-08-29T06:15:09.423",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro ipaddrmsk%d en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46553",
"lastModified": "2024-09-24T16:41:41.600",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.720",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1e21ab70186245aa8fb17578863216e2"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro newProname en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46558",
"lastModified": "2024-09-24T16:41:49.970",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.033",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#43e2ae152385466180ebec957696ceaa"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sProfileName en wizfw.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46588",
"lastModified": "2024-09-24T16:40:55.433",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.957",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#7be91fa3afab4c9c978f7f6c1cc4c847"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:42
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sPeerId en vpn.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46568",
"lastModified": "2024-09-24T16:42:01.687",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.480",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#41a3e5586f424ceb858a5a66836a40cb"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sCloudPass en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46586",
"lastModified": "2024-09-24T16:40:54.183",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.900",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#3d4d22d30d164ef9b8fb1fe1024ada3a"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro saveVPNProfile en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46594",
"lastModified": "2024-09-24T16:41:04.160",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.263",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#33c5e76a919e4f04ae8a7bb039e37131"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sSrvName en service.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46565",
"lastModified": "2024-09-24T16:41:57.440",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.313",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#34ffb536a14f400680eec54e565b25f3"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sBPA_Pwd en inet15.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46551",
"lastModified": "2024-09-24T16:41:38.327",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.590",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#aabdeced2a5e407ba3b3c0d318af0a29"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sBPA_UsrNme en inet15.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46559",
"lastModified": "2024-09-24T16:41:51.380",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.097",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#acee48e159494c479aecc1bfa87f0d83"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sInRCSecret0 en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46556",
"lastModified": "2024-09-24T16:41:46.957",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:16.910",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#a26d36d8c8d042299348d8ec7a0260ca"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sAct en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46596",
"lastModified": "2024-09-24T16:41:07.350",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.353",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#d049794ac4804e48968cb77589d5ec45"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:40
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro AControlIp1 en acontrol.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46584",
"lastModified": "2024-09-24T16:40:50.223",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.790",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#20fb6e1bcec049728e6319d9da46416d"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro sProfileName en fextobj.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46564",
"lastModified": "2024-09-24T16:41:55.907",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.263",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#4ebd20d478124581b01338b89622363a"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro ssidencrypt_5g%d en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46592",
"lastModified": "2024-09-24T16:41:00.260",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:18.170",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1fe94a7181d24f5fbe464a5f9417d084"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-18 15:15
Modified
2024-09-24 16:41
Severity ?
Summary
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| draytek | vigor3910_firmware | 4.3.2.6 | |
| draytek | vigor3910 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:4.3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B242B2F8-ABC2-4CF9-995D-752CAE10EF9A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input."
},
{
"lang": "es",
"value": "Se descubri\u00f3 que Draytek Vigor 3910 v4.3.2.6 conten\u00eda un desbordamiento de b\u00fafer en el par\u00e1metro queryret en v2x00.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una entrada manipulada."
}
],
"id": "CVE-2024-46561",
"lastModified": "2024-09-24T16:41:54.337",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T15:15:17.210",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#48ac749c7e444d8398b414f9d1d48c40"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}