CVE-2024-51138
Published: 27 February 2025
Summary
CVE-2024-51138 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Draytek Vigor2962 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow by applying vendor patches for the affected Draytek Vigor router firmware.
Enforces bounds checking and validation on URL parameters processed by the TR069 STUN server to prevent buffer overflows from malicious requests.
Implements memory protections like stack canaries and non-executable memory to mitigate exploitation of the stack-based buffer overflow even if input validation fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public-facing TR069 STUN server on Draytek routers directly enables arbitrary code execution via crafted network request (T1190).
NVD Description
Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier…
more
a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges.
Deeper analysisAI
CVE-2024-51138 is a stack-based buffer overflow vulnerability (CWE-121) affecting the URL parsing functionality in the TR069 STUN server of multiple Draytek Vigor router models. The flaw impacts Vigor165/166 versions 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5 and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; and Vigor3910 4.4.3.1 and earlier. It stems from insufficient bounds checking on the amount of URL parameters processed.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction by sending a maliciously crafted request to the TR069 STUN server. Successful exploitation triggers the buffer overflow, enabling arbitrary code execution with elevated privileges. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical impact on confidentiality, integrity, and availability.
Advisories providing mitigation guidance, including patches, are available from Draytek at http://draytek.com and in the Faraday Labs report on multiple Draytek router vulnerabilities at https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946.
Details
- CWE(s)