CVE-2024-51138

CVE-2024-51138 is a critical stack-based buffer overflow vulnerability affecting multiple DrayTek Vigor router models, including the Vigor165/166, Vigor2620/LTE200, and others, in various firmware versions. This flaw, stemming from insufficient bounds checking in the TR069 STUN server's URL parsing, allows an unauthenticated remote attacker to execute arbitrary code with elevated privileges by sending a specially crafted request. Rated 9.8 Critical on the CVSS scale, it presents a significant risk due to its network attack vector and high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, suggesting it is not widely known or exploited in the wild.