External risk intelligence

DrayTek Vigor Router Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-51139

The affected products are DrayTek Vigor series routers, which are network edge appliances. These devices are designed to be public-facing gateways and frequently manage external connections, making them highly likely to be reachable from the internet in standard deployments.

Buffer Overflow

Draytek Vigor2620 Firmware

before 3.9.9.1before 3.9.8.3before 3.9.9.8before 3.9.9.2before 4.4.5.5before 4.4.5.8before 4.3.2.94.4.3 to before 4.4.3.2before 4.4.3.2before 4.4.5before 3.9.8.5

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain DrayTek router models that could allow an unauthorized remote attacker to execute arbitrary code, posing a significant security risk to network infrastructure.

Code execution flaw in network routers.
Critical vulnerability, potentially affects network access.
Confirm relevance and exposure to network devices.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted HTTP POST requests to exposed devices, targeting the CGI parser. This could allow them to execute arbitrary code on the affected routers.

Network access required.
Triggered by HTTP POST with malicious header.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on affected DrayTek routers. The attack is possible when the router's CGI parser improperly handles the "Content-Length" header in HTTP POST requests. This could lead to a buffer overflow, potentially compromising the router's functionality and the network it protects.

Router's code execution could be compromised.
Remote code execution via HTTP POST requests.
Compromise of router functionality and network.

Operational Fix

Recommended remediation, mitigation, and detection steps

The management of this vulnerability will likely fall to infrastructure or network teams responsible for DrayTek devices, with vendor-management potentially involved if the devices are procured through a third party. The immediate priority is to identify all instances of the affected Vigor routers within the environment, assess their exposure to external networks, and confirm their business criticality to prioritize remediation efforts.

Infrastructure or Network teams should own this issue.
Verify device exposure and business criticality first.
Plan coordinated firmware updates or replacements.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DrayTek Vigor series?

DrayTek Vigor devices are networking appliances, such as routers and gateways, typically deployed at the edge of a network. They manage traffic flow between internal networks and the internet, providing essential connectivity and security functions for businesses and organizations.

What is the buffer overflow weakness in CVE-2024-51139?

This vulnerability is a buffer overflow, classified as CWE-120. It occurs when a program tries to store more data in a memory buffer than it is designed to hold, causing the excess data to overwrite adjacent memory. In this case, the router's CGI parser improperly handles memory when processing specific HTTP data, which can be manipulated to execute unauthorized code.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted HTTP POST request to the targeted router. Specifically, the attack leverages the device's CGI parser, which mishandles the 'Content-Length' header included in that request. If the header is malformed or intentionally designed, it forces the memory overflow that enables the code execution.

Is my device at risk if it faces the internet?

Yes. Because these routers are edge appliances often positioned to handle external connections, they are frequently reachable from the internet. Halo Surface Signal notes this makes them very likely to be exposed in standard deployments, increasing the importance of checking if your specific device and firmware version are impacted.

What should I do if I use these routers?

First, identify all DrayTek Vigor devices within your network and check their current firmware versions against the list of affected configurations. Once you have an inventory, coordinate with your network or infrastructure team to apply the vendor's provided firmware updates, as updating the software is the primary way to resolve this vulnerability.

References

medium.com/faraday/advisory-multiple-vulnerabilities-affecting-d…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.