CVE-2020-14993: Buffer Overflow
Published Jun 23, 2020
·Updated
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.
Affected Software
6 affected components
DrayTek Vigor300b Firmware<1.5.1.1
DrayTek Vigor300B
DrayTek Vigor2960 Firmware<1.5.1.1
DrayTek Vigor2960
DrayTek Vigor3900 Firmware<1.5.1.1
DrayTek Vigor3900
Remediation
Event History
Jun 23, 2020
CVE Published
via MITRE·11:50 AM
Data Sourced
via MITRE·11:50 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2020-14993.
2
What is the severity of CVE-2020-14993?
The severity of CVE-2020-14993 is critical with a CVSS score of 9.8.
3
Which devices are affected by CVE-2020-14993?
DrayTek Vigor2960, Vigor3900, and Vigor300B devices before version 1.5.1.1 are affected by CVE-2020-14993.
4
How can remote attackers exploit CVE-2020-14993?
Remote attackers can exploit CVE-2020-14993 by sending a malicious formuserphonenumber parameter in an authusersms action to mainfunction.cgi.
5
Are DrayTek Vigor3900 and Vigor2960 devices vulnerable to CVE-2020-14993?
No, DrayTek Vigor3900 and Vigor2960 devices are not vulnerable to CVE-2020-14993.