This vulnerability is a buffer overflow (CWE-120) in the CGI parser of various Vigor router models, triggered by specially crafted HTTP POST requests with manipulated Content-Length headers. Affected devices include Vigor2620/LTE200 (up to 3.9.8.9), Vigor2860/2925 (up to 3.9.8), Vigor2862/2926 (up to 3.9.9.5), Vigor2133/2762/2832 (up to 3.9.9), Vigor165/166 (up to 4.2.7), Vigor2135/2765/2766 (up to 4.4.5.1), Vigor2865/2866/2927 (up to 4.4.5.3), Vigor2962/3910 (up to 4.3.2.8/4.4.3.1), and Vigor3912 (up to 4.3.6.1). Exploitation allows remote code execution without authentication. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on affected devices, potentially leading to full system compromise, data breach, or disruption of network services. The vulnerability affects confidentiality, integrity, and availability (CIA triad) with a CVSS score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the management interface from untrusted networks and consider disabling HTTP POST handling if possible. Monitor vendor communications for updates and apply patches promptly once available.