CVE-2024-41593
high-risk
Published 2024-10-03
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.
Do I need to act?
~
7.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (20)
Vigor3912 Firmware
Vigor2962 Firmware
Vigor165 Firmware
Vigor1000B Firmware
Vigor166 Firmware
Vigor2135 Firmware
Vigor2763 Firmware
Vigor2765 Firmware
Vigor2865 Firmware
Vigor2766 Firmware
Vigor2866 Firmware
Vigor2915 Firmware
Vigor2620 Firmware
Vigorlte200 Firmware
Vigor2133 Firmware
Vigor2762 Firmware
Vigor2832 Firmware
Vigor2860 Firmware
Vigor2862 Firmware
Affected Vendors
References (2)
63
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
10/34 · Low
Exposure
21/34 · High