A stack-based buffer overflow on DrayTek Vigor2960 Vigor3900 and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi.