Vulnerability Details CVE-2021-42911
A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.156
EPSS Ranking 94.3%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2021-42911
-
cpe:2.3:h:draytek:vigor2960:-
-
cpe:2.3:h:draytek:vigor300b:-
-
cpe:2.3:h:draytek:vigor3900:-
-
cpe:2.3:o:draytek:vigor2960_firmware:-
-
cpe:2.3:o:draytek:vigor2960_firmware:1.3.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.5.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.5.1.1
-
cpe:2.3:o:draytek:vigor2960_firmware:1.5.1.3
-
cpe:2.3:o:draytek:vigor300b_firmware:-
-
cpe:2.3:o:draytek:vigor300b_firmware:1.3.3
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.2.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.4.4
-
cpe:2.3:o:draytek:vigor300b_firmware:1.5.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.5.1.1
-
cpe:2.3:o:draytek:vigor300b_firmware:1.5.1.3
-
cpe:2.3:o:draytek:vigor3900_firmware:-
-
cpe:2.3:o:draytek:vigor3900_firmware:1.4.4
-
cpe:2.3:o:draytek:vigor3900_firmware:1.5.1
-
cpe:2.3:o:draytek:vigor3900_firmware:1.5.1.1
-
cpe:2.3:o:draytek:vigor3900_firmware:1.5.1.3