CVE-2024-46589

Name of the Vulnerable Software and Affected Versions DrayTek Vigor version 4.3.2.6

Description The issue is related to a buffer overflow on the stack when handling the sIpv6AiccuUser parameter, which can lead to a Denial of Service (DoS) when exploited. This can be caused by a crafted input to the inetipv6.cgi endpoint.

Recommendations For version 4.3.2.6, consider restricting access to the inetipv6.cgi endpoint until a patch is available. As a temporary workaround, avoid using the sIpv6AiccuUser parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.