CVE-2024-46584
📋 TL;DR
A buffer overflow vulnerability exists in the AControlIp1 parameter of the acontrol.cgi component in Draytek Vigor 3910 firmware version 4.3.2.6. Attackers can exploit this by sending specially crafted input to cause a Denial of Service (DoS), potentially crashing the device. Organizations using this specific firmware version on Vigor 3910 routers are affected.
💻 Affected Systems
- Draytek Vigor 3910
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, extended service disruption, and potential remote code execution if the overflow can be controlled to execute arbitrary code.
Likely Case
Denial of Service causing device reboot and temporary network outage for connected users.
If Mitigated
Limited impact if device is behind firewall with restricted access to management interface.
🎯 Exploit Status
Buffer overflow in CGI parameter suggests straightforward exploitation via HTTP request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Draytek website for firmware updates. 2. Download latest firmware. 3. Access router web interface. 4. Navigate to System Maintenance > Firmware Upgrade. 5. Upload new firmware file. 6. Wait for reboot.
🔧 Temporary Workarounds
Restrict access to management interface
allLimit access to the router's web interface to trusted IP addresses only.
Disable WAN access to management
allEnsure router management is not accessible from the internet.
🧯 If You Can't Patch
- Isolate vulnerable device in separate network segment with strict firewall rules.
- Implement network monitoring for abnormal HTTP requests to acontrol.cgi.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Maintenance > Firmware Information.Check Version:
No CLI command; use web interface at System Maintenance > Firmware Information.Verify Fix Applied:
Verify firmware version is no longer v4.3.2.6 after update.📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP requests to /acontrol.cgi with abnormal parameter lengths
- Device reboot logs without normal shutdown
Network Indicators:
- HTTP POST requests to /acontrol.cgi with unusually long AControlIp1 parameter values
SIEM Query:
http.url:"/acontrol.cgi" AND http.param:"AControlIp1" AND bytes_out > 1000