CVE-2024-51138: Buffer Overflow
Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51138?
CVE-2024-51138 has a critical severity rating due to potential unauthorized access vulnerabilities.
How do I fix CVE-2024-51138?
To fix CVE-2024-51138, update your DrayTek device firmware to the latest version as specified by the vendor.
Which devices are affected by CVE-2024-51138?
CVE-2024-51138 affects multiple DrayTek routers including Vigor165, Vigor166, Vigor2620, LTE200, Vigor2860, and others.
When was CVE-2024-51138 reported?
CVE-2024-51138 was reported in 2024, highlighting vulnerabilities across various DrayTek devices.
What are the potential impacts of CVE-2024-51138?
The potential impacts of CVE-2024-51138 include unauthorized access and control over affected DrayTek devices.