CVE Feed

    Dashboard / CVE / CVE-2024-46580

    CVE-2024-46580

    Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

    Published:Sep 18, 2024
    Last Modified:Mar 14, 2025
    EPS:Sep 18, 2024
    EPSS Score:0.00196
    CVSS Score:7.5

    Affected Products

    Vendor
    Draytek
    Product
    Vigor3910
    Vendor
    Draytek
    Product
    Vigor3910 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-41339 (CVSS 8.8) — An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , …
    CVE-2024-41334 (CVSS 8.8) — Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to …
    CVE-2024-41340 (CVSS 8.4) — An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29…
    CVE-2024-51139 (CVSS 9.8) — Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and…
    CVE-2024-51138 (CVSS 9.8) — Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2…
    CVE-2024-41338 (CVSS 7.5) — A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.…
    CVE-2024-41584 (CVSS 4.7) — DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by mi…
    CVE-2024-41590 (CVSS 8) — Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds ch…
    CVE-2024-41585 (CVSS 6.8) — DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an…
    CVE-2024-41596 (CVSS 8) — Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI)…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High