CVE-2024-46560
📋 TL;DR
A buffer overflow vulnerability in Draytek Vigor 3910 routers allows attackers to cause Denial of Service (DoS) by sending specially crafted input to the pub_key parameter. This affects organizations using Draytek Vigor 3910 routers with vulnerable firmware. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- Draytek Vigor 3910
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potential for remote code execution if buffer overflow can be controlled precisely (though not confirmed in this CVE).
Likely Case
Router becomes unresponsive, requiring reboot to restore service, disrupting network connectivity for all connected devices.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access, though internal threats remain possible.
🎯 Exploit Status
The vulnerability is in v2x00.cgi which handles web interface requests, making it accessible via HTTP/HTTPS.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: Yes
Instructions:
1. Check Draytek website for firmware updates. 2. Download latest firmware for Vigor 3910. 3. Log into router web interface. 4. Navigate to System Maintenance > Firmware Upgrade. 5. Upload new firmware file. 6. Wait for reboot.
🔧 Temporary Workarounds
Restrict Web Interface Access
linuxLimit access to router's web management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Unnecessary Services
allDisable remote web management if not required.
🧯 If You Can't Patch
- Place router behind additional firewall with strict inbound rules
- Implement network segmentation to limit router exposure
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Maintenance > Firmware InformationCheck Version:
curl -k https://ROUTER_IP/cgi-bin/v2x00.cgi?pub_key=test (monitor for crash/response)Verify Fix Applied:
Verify firmware version is no longer v4.3.2.6 after update📡 Detection & Monitoring
Log Indicators:
- Router reboot logs
- Web interface access logs showing requests to v2x00.cgi with long pub_key parameters
Network Indicators:
- HTTP/HTTPS requests to router IP on ports 80/443 with abnormal parameter lengths
- Sudden loss of router connectivity
SIEM Query:
source="router_logs" AND (uri="*/v2x00.cgi*" AND param_length>1000)