{"id":"CVE-2024-41590","aliases":["EUVD-2024-39087","GHSA-gx28-329m-22gw"],"status":"published","title":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of...","description":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00329,"percentile":0.26227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2024-10-03T00:00:00Z","modified":"2026-06-17T07:47:52Z","products":[{"vendor":"draytek","product":"vigor1000b_firmware"},{"vendor":"draytek","product":"vigor165_firmware"},{"vendor":"draytek","product":"vigor166_firmware"},{"vendor":"draytek","product":"vigor2133_firmware"},{"vendor":"draytek","product":"vigor2135_firmware"},{"vendor":"draytek","product":"vigor2620_firmware"},{"vendor":"draytek","product":"vigor2762_firmware"},{"vendor":"draytek","product":"vigor2763_firmware"},{"vendor":"draytek","product":"vigor2765_firmware"},{"vendor":"draytek","product":"vigor2766_firmware"},{"vendor":"draytek","product":"vigor2832_firmware"},{"vendor":"draytek","product":"vigor2860_firmware"},{"vendor":"draytek","product":"vigor2862_firmware"},{"vendor":"draytek","product":"vigor2865_firmware"},{"vendor":"draytek","product":"vigor2866_firmware"},{"vendor":"draytek","product":"vigor2915_firmware"},{"vendor":"draytek","product":"vigor2925_firmware"},{"vendor":"draytek","product":"vigor2926_firmware"},{"vendor":"draytek","product":"vigor2952_firmware"},{"vendor":"draytek","product":"vigor2962_firmware"},{"vendor":"draytek","product":"vigor3220_firmware"},{"vendor":"draytek","product":"vigor3910_firmware"},{"vendor":"draytek","product":"vigor3912_firmware"},{"vendor":"draytek","product":"vigorlte200_firmware"}],"references":[{"url":"https://www.forescout.com/resources/draytek14-vulnerabilities","tags":["Broken Link"]},{"url":"https://www.forescout.com/resources/draybreak-draytek-research/","tags":["Mitigation","Technical Description","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41590"},{"url":"https://www.forescout.com/resources/draybreak-draytek-research"},{"url":"https://github.com/advisories/GHSA-gx28-329m-22gw"}],"sources":{"cve":[{"id":"CVE-2024-41590","description":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.","status":"published","published":"2024-10-03T00:00:00Z","modified":"2024-10-03T20:38:44.42Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-39087","description":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.","status":"published","published":"2024-10-03T00:00:00Z","modified":"2024-10-03T20:38:44Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:52.849961Z"}],"ghsa":[{"id":"GHSA-gx28-329m-22gw","title":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of...","description":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.","status":"published","published":"2024-10-03T21:31:04Z","modified":"2024-10-07T21:34:32Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:58:25.780996Z"}],"nvd":[{"id":"CVE-2024-41590","description":"Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.","status":"published","published":"2024-10-03T19:15:04.487Z","modified":"2026-06-17T07:47:52.88Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:10:30.673028Z"}]}}