CVE-2021-42911
First published: Tue Mar 29 2022(Updated: )
A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Draytek Vigor2960 Firmware | <=1.5.1.3 | |
| DrayTek Vigor2960 | ||
| Draytek Vigor3900 Firmware | <=1.5.1.3 | |
| DrayTek Vigor3900 | ||
| Draytek Vigor300b Firmware | <=1.5.1.3 | |
| Draytek Vigor300b |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2021-42911?
CVE-2021-42911 is a Format String vulnerability that exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file.
How can a remote user exploit CVE-2021-42911?
A remote user can exploit CVE-2021-42911 by sending a crafted HTTP message containing a malformed QUERY STRING, which could allow them to execute arbitrary code.
What is the severity of CVE-2021-42911?
CVE-2021-42911 has a severity rating of 9.8 (Critical).
Which DrayTek products are affected by CVE-2021-42911?
The DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 are affected by CVE-2021-42911.
Is the DrayTek Vigor 2960 vulnerable to CVE-2021-42911?
Yes, the DrayTek Vigor 2960 <= 1.5.1.3 is vulnerable to CVE-2021-42911.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- vendor/draytek
- canonical/draytek vigor2960 firmware
- version/draytek vigor2960 firmware/1.5.1.3
- canonical/draytek vigor2960
- canonical/draytek vigor3900 firmware
- version/draytek vigor3900 firmware/1.5.1.3
- canonical/draytek vigor3900
- canonical/draytek vigor300b firmware
- version/draytek vigor300b firmware/1.5.1.3
- canonical/draytek vigor300b