CVE-2024-51138 is a stack-based buffer overflow vulnerability in the URL parsing component of the TR069 STUN server on various DrayTek Vigor router models. The vulnerability arises from insufficient bounds checking on the number of URL parameters, allowing a remote attacker to send a maliciously crafted request that triggers the overflow. Successful exploitation can result in arbitrary code execution with elevated privileges, compromising the affected device. The vulnerability affects multiple firmware versions across several Vigor models, including but not limited to Vigor165/166 (<=4.2.7), Vigor2620/LTE200 (<=3.9.8.9), Vigor2860/2925 (<=3.9.8), Vigor2862/2926 (<=3.9.9.5), Vigor2133/2762/2832 (<=3.9.9), Vigor2135/2765/2766 (<=4.4.5), Vigor2865/2866/2927 (<=4.4.5.3), Vigor2962 (<=4.3.2.8), Vigor3912 (<=4.3.6.1), and Vigor3910 (<=4.4.3.1). The CVSS v3.1 base score is 9.8, reflecting critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

The vulnerability allows remote attackers to execute arbitrary code with elevated privileges on affected DrayTek Vigor devices by exploiting a stack-based buffer overflow in the TR069 STUN server's URL parsing. This can lead to full compromise of the device, including unauthorized control, data disclosure, and disruption of service. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the TR069 STUN server functionality if possible, or limit network exposure of affected devices. Monitor vendor communications for updates and apply patches promptly once available.