CVE-2024-41593 Information

Description

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns() because a byte sign-extension operation occurs for the length argument of a _memcpy call leading to a heap-based Buffer Overflow.

Reference

https://www.forescout.com/resources/draytek14-vulnerabilities https://www.forescout.com/resources/draybreak-draytek-research/