External risk intelligence

DrayTek Vigor Routers TR069 URL Parsing Stack Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-51138

The vulnerability affects DrayTek Vigor routers, which are commonly deployed as internet-facing edge gateways and network appliances. The affected functionality, a TR-069 STUN server, is typically used for remote management and configuration by ISPs or administrators, representing an externally reachable surface in many standard deployment scenarios.

Buffer Overflow

Draytek Vigor3912 Firmware

before 4.4.3.2before 3.9.9.1before 3.9.8.3before 3.9.9.8before 3.9.9.2before 4.4.5.5before 4.4.5.8before 4.3.2.94.4.3 to before 4.4.3.2before 4.4.5before 3.9.8.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server on various DrayTek Vigor devices. This flaw allows for remote code execution with elevated privileges if exploited, potentially impacting network security and device integrity.

Attackers can exploit a flaw in URL processing.
This enables unauthorized code execution on routers.
Confirm relevance and potential exposure to affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a stack-based buffer overflow in the URL parsing of the TR-069 STUN server by sending a specially crafted request. This allows them to execute arbitrary code with higher privileges on the affected devices.

No authentication needed.
Malicious URL in TR-069 request.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in the URL parsing functionality of the TR-069 STUN server could allow a remote attacker to execute arbitrary code with elevated privileges when sending a maliciously crafted request. This occurs due to insufficient bounds checking on URL parameters.

System data and service behavior.
Maliciously crafted network requests.
Unauthorized code execution and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in DrayTek Vigor routers' TR-069 STUN server requires immediate attention from network and security teams responsible for managing internet-facing devices. The first practical step is to identify all deployed Vigor devices, confirm their exposure to the internet, and determine their business criticality to prioritize remediation efforts with the accountable owner.

Network and security teams own remediation.
Verify internet exposure and business criticality first.
Plan immediate updates or mitigating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DrayTek Vigor equipment affected by CVE-2024-51138?

These devices are networking routers and security gateways used by businesses and service providers to manage internet traffic, VPN connections, and network routing. The affected models, such as the Vigor2865, Vigor2927, and Vigor3912, act as central hubs for connectivity. They often utilize the TR-069 protocol, which allows internet service providers or IT teams to remotely configure, manage, and update the router’s settings.

How does this stack-based buffer overflow work?

This vulnerability is a memory management flaw, specifically identified as CWE-121. It occurs when the router's TR-069 STUN server processes incoming URL data without properly checking if the input fits into the allocated memory space. By sending a carefully constructed, overly long URL parameter, an attacker can overwrite adjacent memory. This allows the system to inadvertently execute unauthorized instructions instead of processing the data, granting the attacker control over the device.

Do I need to be authenticated for an attacker to trigger this bug?

No. The vulnerability exists within the URL parsing logic of the TR-069 STUN server, which processes incoming requests. An attacker does not need legitimate administrative credentials or prior access to the router to send these malicious requests. Simply having the ability to reach the service over the network is sufficient. Normal management traffic that follows standard, expected URL formatting will not trigger the overflow.

How do I know if my DrayTek routers are at risk?

According to Halo Surface Signal, these routers are commonly used as internet-facing gateways, making them highly visible to remote actors. You should prioritize assessing any devices that have their management or TR-069 interfaces exposed directly to the internet. If a router is strictly used within an isolated internal network without internet reachability, the immediate risk is reduced, though it remains a concern if internal segments are compromised.

What is the first step to remediate this vulnerability?

The most effective action is to identify all DrayTek Vigor devices currently in your environment and compare their firmware versions against the vendor's secure release requirements. Because this is a critical issue involving elevated privileges, prioritize patching devices that are internet-facing. Contact your network administrator to schedule firmware updates and ensure no unauthorized services are unnecessarily exposed to the outside web.

References

medium.com/faraday/advisory-multiple-vulnerabilities-affecting-d…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.