CVE-2024-51139
Published: 27 February 2025
Summary
CVE-2024-51139 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Draytek Vigor2962 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow vulnerability by applying vendor-provided firmware patches for affected Draytek Vigor routers.
Requires validation and sanitization of the Content-Length header in HTTP POST requests to the CGI parser, preventing the buffer overflow trigger.
Implements memory protections such as address space randomization and stack guards to mitigate successful exploitation of the buffer overflow for arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing CGI/HTTP parser enables remote unauthenticated RCE on network device.
NVD Description
Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910…
more
4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.
Deeper analysisAI
CVE-2024-51139 is a buffer overflow vulnerability (CWE-120) affecting the CGI parser in multiple Draytek Vigor router models. It impacts Vigor2620/LTE200 firmware 3.9.8.9 and earlier, Vigor2860/2925 3.9.8 and earlier, Vigor2862/2926 3.9.9.5 and earlier, Vigor2133/2762/2832 3.9.9 and earlier, Vigor165/166 4.2.7 and earlier, Vigor2135/2765/2766 4.4.5.1 and earlier, Vigor2865/2866/2927 4.4.5.3 and earlier, Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier, and Vigor3912 4.3.6.1 and earlier. The flaw arises from improper handling of the "Content-Length" header in HTTP POST requests, earning a CVSS v3.1 base score of 9.8 (Critical).
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted HTTP POST request with a manipulated "Content-Length" header, the attacker triggers the buffer overflow in the CGI parser, enabling arbitrary code execution on the affected device. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially allowing full router compromise, such as backdoor installation or traffic redirection.
Vendor advisories and third-party reports, including those from Draytek at http://draytek.com and Faraday Labs at https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946, address this among multiple Draytek router vulnerabilities. Mitigation requires updating to firmware versions later than those listed as vulnerable, as patches are available from the vendor.
Details
- CWE(s)