Details of VAR-202003-0306

ID

VAR-202003-0306

CVE

CVE-2020-10823

TITLE

plural DrayTek Out-of-bounds write vulnerabilities in product devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-003500

DESCRIPTION

A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3). Draytek Vigor3900 , Vigor2960 , Vigor300B The device is vulnerable to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. DrayTek Vigor3900 and others are products of DrayTek Corporation of Taiwan. DrayTek Vigor3900 is a broadband router/VPN gateway device. Vigor2960 is a load balancing router and VPN gateway device. Vigor300B is a load balancing router. There is a buffer overflow vulnerability in the /cgi-bin/activate.cgi file in Draytek Vigor3900 versions prior to 1.5.1, Vigor2960 versions prior to 1.5.1 and Vigor300B versions prior to 1.5.1. This vulnerability stems from the program's failure to correctly check the boundary

Trust: 2.16

sources: NVD: CVE-2020-10823 // JVNDB: JVNDB-2020-003500 // CNVD: CNVD-2020-29578

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-29578

AFFECTED PRODUCTS

vendor:	draytek	model:	vigor3900	scope:	lt	version:	1.5.1	Trust: 1.6
vendor:	draytek	model:	vigor2960	scope:	lt	version:	1.5.1	Trust: 1.6
vendor:	draytek	model:	vigor300b	scope:	lt	version:	1.5.1	Trust: 1.6
vendor:	draytek	model:	vigor2960	scope:	eq	version:	1.5.1	Trust: 0.8
vendor:	draytek	model:	vigor300b	scope:	eq	version:	1.5.1	Trust: 0.8
vendor:	draytek	model:	vigor3900	scope:	eq	version:	1.5.1	Trust: 0.8

sources: CNVD: CNVD-2020-29578 // JVNDB: JVNDB-2020-003500 // NVD: CVE-2020-10823

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-10823
value:	CRITICAL
Trust: 1.0
NVD:	JVNDB-2020-003500
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2020-29578
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202003-1634
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2020-10823
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-003500
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-29578
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-10823
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-003500
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-29578 // JVNDB: JVNDB-2020-003500 // CNNVD: CNNVD-202003-1634 // NVD: CVE-2020-10823

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.8

sources: JVNDB: JVNDB-2020-003500 // NVD: CVE-2020-10823

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-1634

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202003-1634

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-003500

PATCH

title:

Vigor3900 / Vigor2960 / Vigor300B Stack-based buffer overflow Vulnerability (CVE-2020-10823 ~ CVE-2020-10828)

url:

https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/

Trust: 0.8

sources: JVNDB: JVNDB-2020-003500

EXTERNAL IDS

db:	NVD	id:	CVE-2020-10823	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-003500	Trust: 0.8
db:	CNVD	id:	CNVD-2020-29578	Trust: 0.6
db:	CNNVD	id:	CNNVD-202003-1634	Trust: 0.6

sources: CNVD: CNVD-2020-29578 // JVNDB: JVNDB-2020-003500 // CNNVD: CNNVD-202003-1634 // NVD: CVE-2020-10823

REFERENCES

url:	https://slashd.ga/2020/03/draytek-vulnerabilities/	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2020-10823	Trust: 2.0
url:	https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10823	Trust: 0.8

sources: CNVD: CNVD-2020-29578 // JVNDB: JVNDB-2020-003500 // CNNVD: CNNVD-202003-1634 // NVD: CVE-2020-10823

SOURCES

db:	CNVD	id:	CNVD-2020-29578
db:	JVNDB	id:	JVNDB-2020-003500
db:	CNNVD	id:	CNNVD-202003-1634
db:	NVD	id:	CVE-2020-10823

LAST UPDATE DATE

2024-11-23T22:41:09.816000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-29578	date:	2020-05-23T00:00:00
db:	JVNDB	id:	JVNDB-2020-003500	date:	2020-04-17T00:00:00
db:	CNNVD	id:	CNNVD-202003-1634	date:	2020-06-24T00:00:00
db:	NVD	id:	CVE-2020-10823	date:	2024-11-21T04:56:08.807

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-29578	date:	2020-05-23T00:00:00
db:	JVNDB	id:	JVNDB-2020-003500	date:	2020-04-17T00:00:00
db:	CNNVD	id:	CNNVD-202003-1634	date:	2020-03-26T00:00:00
db:	NVD	id:	CVE-2020-10823	date:	2020-03-26T17:15:23.203