CVE-2024-41593

Summary

CVE-2024-41593 is a newly disclosed vulnerability affecting DrayTek Vigor310 devices up to version 4.3.2.6. This issue stems from a heap-based buffer overflow in the function ft_payload_dns(). The length argument of a _memcpy call undergoes a byte sign-extension operation, allowing a remote attacker to execute arbitrary code by overwriting memory beyond the intended bounds. This vulnerability poses a significant risk, as successful exploitation could result in unauthorized access, data theft, or system compromise. Users are strongly urged to update their devices to a patched version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.