CVE-2020-10823: Buffer Overflow
Published Mar 26, 2020
·Updated
A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).
Affected Software
12 affected components
DrayTek Vigor300b Firmware<1.5.1
DrayTek Vigor300B
DrayTek Vigor3900 Firmware<1.5.1
DrayTek Vigor3900
DrayTek Vigor2960 Firmware<1.5.1
DrayTek Vigor2960
All of the following
DrayTek Vigor300b Firmware<1.5.1
DrayTek Vigor300B
All of the following
DrayTek Vigor3900 Firmware<1.5.1
DrayTek Vigor3900
All of the following
DrayTek Vigor2960 Firmware<1.5.1
DrayTek Vigor2960
Event History
Mar 26, 2020
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2020-10823.
2
What is the severity of CVE-2020-10823?
The severity of CVE-2020-10823 is critical with a CVSS score of 9.8.
3
Which devices are affected by CVE-2020-10823?
Draytek Vigor3900, Vigor2960, and Vigor300B devices before version 1.5.1 are affected by this vulnerability.
4
How can remote attackers exploit CVE-2020-10823?
Remote attackers can achieve code execution by sending a remote HTTP request through the var parameter in /cgi-bin/activate.cgi.
5
Are Draytek Vigor300B, Vigor3900, and Vigor2960 devices vulnerable?
Draytek Vigor300B, Vigor3900, and Vigor2960 devices are vulnerable to CVE-2020-10823 if they are running firmware versions before 1.5.1.