Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

vigor310

Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters.

CVE-2024-41596 identifies a buffer overflow vulnerability in DrayTek Vigor310 series devices running firmware versions through 4.3.2.6. The vulnerability arises from improper retrieval and handling of CGI form parameters within the Vigor management UI, which is the web-based interface used for device configuration and management. Buffer overflow occurs when input data exceeds the allocated buffer size, potentially allowing an attacker to overwrite memory and execute arbitrary code. The CVSS 3.1 base score of 8.0 reflects a high severity, with an attack vector classified as adjacent network (AV:A), requiring low attack complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), but the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), indicating that successful exploitation can fully compromise the device. Although no public exploits or patches are currently available, the vulnerability represents a significant risk due to the critical role of DrayTek Vigor310 devices in network infrastructure, including routing and firewall functions. The CWE-120 classification confirms this is a classic buffer overflow issue, a well-known and dangerous vulnerability type. Attackers with network adjacency and low-level credentials could leverage this flaw to gain control over the device, potentially pivoting into internal networks or disrupting services.

Detailed information about CVE-2024-41596: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-41596: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-41596: n/a

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds checks on read and write operations.

CVE-2024-41595 is a vulnerability identified in DrayTek Vigor310 series devices running firmware versions up to 4.3.2.6. The issue arises due to missing bounds checks on read and write operations within the device's .cgi web interface pages. Specifically, the vulnerability allows a remote attacker with low privileges (authenticated access) to perform out-of-bounds read and write operations, which can lead to unauthorized modification of device settings or cause a denial of service (DoS) condition. The underlying weaknesses correspond to CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write), indicating that the device firmware does not properly validate input sizes or memory boundaries when processing requests. The CVSS v3.1 base score is 8.0, reflecting high severity, with attack vector as adjacent network (AV:A), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). This means an attacker with some level of access to the device's network segment can exploit the vulnerability without user interaction to fully compromise the device's configuration or disrupt its operation. No public patches or exploits are currently known, but the vulnerability's nature suggests that exploitation could lead to significant operational impact, including loss of device control or network outages. The affected devices are commonly used in small to medium business and enterprise environments for network routing and VPN services, making this a critical concern for network security.

Detailed information about CVE-2024-41595: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-41595: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-41595: n/a

Vigor310

A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component.

CVE-2024-41586 is a stack-based buffer overflow vulnerability identified in DrayTek Vigor310 series devices running firmware versions through 4.3.2.6. The flaw exists in the cgi-bin/ipfedr.cgi component, which processes query strings. An attacker with low-level privileges can remotely send an excessively long query string to this CGI endpoint, causing a stack buffer overflow. This overflow can be leveraged to execute arbitrary code on the device, potentially allowing the attacker to gain control over the device's operating system. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow), indicating improper bounds checking on input data. The CVSS v3.1 score is 8.0, reflecting high severity due to the vulnerability's ability to compromise confidentiality, integrity, and availability without requiring user interaction. The attack vector is adjacent network (AV:A), requiring low privileges (PR:L) but no user interaction (UI:N). The vulnerability scope is unchanged (S:U), meaning the exploit affects only the vulnerable component. No public exploit code or patches have been released as of the publication date, but the potential for exploitation is significant given the nature of the flaw and the critical role of these devices in network infrastructure.

Detailed information about CVE-2024-41586: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2024-41596: n/aCVE-2024-41596 0 Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters. HighVulnerabilityUnited StatesUnited KingdomGermany+7#cve #cve-2024-41596 Join the discussion	CVE Database V5	10/03/2024, 00:00:00 UTC Added: 02/25/2026, 21:42:20 UTC
CVE-2024-41595: n/aCVE-2024-41595 0 DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds checks on read and write operations. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-41595 Join the discussion	CVE Database V5	10/03/2024, 00:00:00 UTC Added: 02/25/2026, 21:42:20 UTC
CVE-2024-41586: n/aCVE-2024-41586 0 A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query string to the cgi-bin/ipfedr.cgi component. HighVulnerabilityUnited StatesUnited KingdomGermany+7#cve #cve-2024-41586 Join the discussion	CVE Database V5	10/03/2024, 00:00:00 UTC Added: 02/25/2026, 21:42:19 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional