High severity · published Feb 27, 2025
CVE-2024-41340
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor…
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Vigor165 Firmware · Draytek
before 4.2.7 · source: NVD
VF
Vigor166 Firmware · Draytek
before 4.2.7 · source: NVD
VF
Vigor2133 Firmware · Draytek
before 3.9.9 · source: NVD
VF
Vigor2135 Firmware · Draytek
before 4.4.5.1 · source: NVD
VF
Vigor2620 Firmware · Draytek
before 3.9.8.9 · source: NVD
VF
Vigor2762 Firmware · Draytek
before 3.9.9 · source: NVD
VF
Vigor2765 Firmware · Draytek
before 4.4.5.1 · source: NVD
VF
Vigor2766 Firmware · Draytek
before 4.4.5.1 · source: NVD
VF
Vigor2832 Firmware · Draytek
before 3.9.9 · source: NVD
VF
Vigor2860 Firmware · Draytek
before 3.9.8 · source: NVD
VF
Vigor2862 Firmware · Draytek
before 3.9.9.5 · source: NVD
VF
Vigor2865 Firmware · Draytek
before 4.4.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41340
Third Party Advisory
https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
More from Vigor165 Firmware
9.8
CVE-2024-41593
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for…
9.8
CVE-2022-32548
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1
8.8
CVE-2024-41339
An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7,…
8.8
CVE-2024-41334
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior…
8.0
CVE-2024-41596
Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form…