CVE-2024-46591
📋 TL;DR
A buffer overflow vulnerability in Draytek Vigor 3910 routers allows attackers to cause Denial of Service (DoS) by sending specially crafted input to the sDnsPro parameter. This affects organizations using Draytek Vigor 3910 routers with vulnerable firmware versions. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- Draytek Vigor 3910
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, disrupting all network services for connected users and potentially causing extended downtime.
Likely Case
Router becomes unresponsive, requiring manual reboot and causing temporary network disruption for all connected devices.
If Mitigated
Network segmentation and proper firewall rules prevent exploitation attempts, maintaining router functionality.
🎯 Exploit Status
Buffer overflow in CGI parameter suggests straightforward exploitation via HTTP requests to the web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available in provided references
Restart Required: Yes
Instructions:
1. Check Draytek website for firmware updates
2. Download latest firmware for Vigor 3910
3. Backup current configuration
4. Upload and install new firmware via web interface
5. Restart router
6. Restore configuration if needed
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to router web management interface to trusted IP addresses only
Configure firewall rules to restrict access to router management IP/ports
Disable Remote Management
allTurn off web management interface access from WAN/Internet
In router settings: Management > Access Control > Disable 'Allow management from WAN'
🧯 If You Can't Patch
- Implement strict network segmentation to isolate router management interface
- Deploy network-based IPS/IDS to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: System Maintenance > Firmware InformationCheck Version:
Not applicable - check via web interface or SSH if enabledVerify Fix Applied:
Verify firmware version is newer than v4.3.2.6 and test web interface functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed HTTP requests to v2x00.cgi
- Router reboot events in system logs
- Unusual traffic patterns to router management interface
Network Indicators:
- HTTP POST requests to /v2x00.cgi with large sDnsPro parameter
- Sudden drop in router responsiveness
SIEM Query:
source="router_logs" AND (uri="/v2x00.cgi" OR event="reboot")