CVE-2024-41592

Summary

CVE-2024-41592 is a stack-based overflow vulnerability affecting DrayTek Vigor3910 devices up to version 4.3.2.6. The issue stems from the GetCGI function's mishandling of extraneous ampersand characters and long key-value pairs in query string parameters, leading to buffer overflows and potential code injection attacks. Successful exploitation of this vulnerability could allow attackers to execute arbitrary code on the affected devices, posing a significant risk to network security. Organizations using DrayTek Vigor3910 devices are strongly encouraged to update to the latest firmware version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.