critical9.8
CVE-2020-14993
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the f…
Impact
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Draytek | Vigor300b Firmware | before 1.5.1.1 |
| Draytek | Vigor2960 Firmware | before 1.5.1.1 |
| Draytek | Vigor3900 Firmware | before 1.5.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/dexterone/Vigor-poc
- https://www.draytek.com/about/security-advisory
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473%29
- https://github.com/dexterone/Vigor-poc
- https://www.draytek.com/about/security-advisory
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473%29