CVE-2024-51139: DrayTek VIGOR1000B Firmware

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.

Affected products

  • DrayTek VIGOR1000B Firmware: before 4.4.3.2 (fixed in 4.4.3.2)
  • DrayTek VIGOR2133 Firmware: before 3.9.9.2 (fixed in 3.9.9.2)
  • DrayTek VIGOR2135 Firmware: before 4.4.5.5 (fixed in 4.4.5.5)
  • DrayTek VIGOR2620 Firmware: before 3.9.9.1 (fixed in 3.9.9.1)
  • DrayTek VIGOR2762 Firmware: before 3.9.9.2 (fixed in 3.9.9.2)
  • DrayTek VIGOR2763 Firmware: before 4.4.5.5 (fixed in 4.4.5.5)
  • DrayTek VIGOR2765 Firmware: before 4.4.5.5 (fixed in 4.4.5.5)
  • DrayTek VIGOR2766 Firmware: before 4.4.5.5 (fixed in 4.4.5.5)
  • DrayTek VIGOR2832 Firmware: before 3.9.9.2 (fixed in 3.9.9.2)
  • DrayTek VIGOR2860 Firmware: before 3.9.8.3 (fixed in 3.9.8.3)
  • DrayTek VIGOR2862 Firmware: before 3.9.9.8 (fixed in 3.9.9.8)
  • DrayTek VIGOR2865 Firmware: before 4.4.5.8 (fixed in 4.4.5.8)
  • DrayTek VIGOR2866 Firmware: before 4.4.5.8 (fixed in 4.4.5.8)
  • DrayTek VIGOR2915 Firmware: before 4.4.5 (fixed in 4.4.5)
  • DrayTek VIGOR2925 Firmware: before 3.9.8.3 (fixed in 3.9.8.3)
  • DrayTek VIGOR2926 Firmware: before 3.9.9.8 (fixed in 3.9.9.8)
  • DrayTek VIGOR2927 Firmware: before 4.4.5.8 (fixed in 4.4.5.8)
  • DrayTek VIGOR2952 Firmware: before 3.9.8.5 (fixed in 3.9.8.5)
  • DrayTek VIGOR2962 Firmware: before 4.3.2.9 (fixed in 4.3.2.9); from 4.4.3, before 4.4.3.2 (fixed in 4.4.3.2)
  • DrayTek VIGOR3220 Firmware: before 3.9.8.5 (fixed in 3.9.8.5)
  • DrayTek VIGOR3910 Firmware: before 4.3.2.9 (fixed in 4.3.2.9); from 4.4.3, before 4.4.3.2 (fixed in 4.4.3.2)
  • DrayTek VIGOR3912 Firmware: before 4.4.3.2 (fixed in 4.4.3.2)
  • DrayTek VIGORLTE200 Firmware: before 3.9.9.1 (fixed in 3.9.9.1)

Published 2025-02-27. Last modified 2026-07-05.