← Database

CVE-2024-41593

CRITICAL CVSS: 9.8 Published: 2024-10-03 Modified: 2026-06-17

Description

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.

Affected Platforms

Draytek Vigor2763 FirmwareDraytek Vigor2926 FirmwareDraytek Vigor3910 FirmwareDraytek Vigor2952Draytek Vigorlte200 FirmwareDraytek Vigor165Draytek Vigor3910Draytek Vigor3220 FirmwareDraytek Vigorlte200Draytek Vigor2762

Weakness Type

CWE-787, CWE-787

References