CVE-2024-51138

Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges.

• CWE-121

• https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946Third Party Advisory

Published

Feb 27, 2025

Last Modified

Jul 5, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51123An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4…7.5
• CVE-2024-51127An issue in the createTempFile method of hornetq v2.4.9 allo…7.1
• CVE-2024-5113A vulnerability was found in Campcodes Complete Web-Based Sc…6.5
• CVE-2024-51132An XML External Entity (XXE) vulnerability in HAPI FHIR befo…9.8
• CVE-2024-51135An XML External Entity (XXE) vulnerability in the component …9.8
• CVE-2024-51136An XML External Entity (XXE) vulnerability in Dmoz2CSV in op…9.8
• CVE-2024-51139Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 an…9.8
• CVE-2024-5114A vulnerability classified as critical has been found in Cam…6.5
• CVE-2024-51141An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allow…7.8
• CVE-2024-51142Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 …5.4
• CVE-2024-51144Cross Site Request Forgery (CSRF) vulnerability exists in th…8.8
• CVE-2024-5115A vulnerability classified as critical was found in Campcode…6.5