SecuriTricks - CVE-2024-41340

Description

An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.

Product(s) Impacted

Product	Versions
Draytek Vigor 165/166	['before v4.2.6']
Draytek Vigor 2620/LTE200	['before v3.9.8.8']
Draytek Vigor 2860/2925	['before v3.9.7']
Draytek Vigor 2862/2926	['before v3.9.9.4']
Draytek Vigor 2133/2762/2832	['before v3.9.8']
Draytek Vigor 2135/2765/2766	['before v4.4.5.1']
Draytek Vigor 2865/2866/2927	['before v4.4.5.3']
Draytek Vigor 2962/3910	['before v4.3.2.7']
Draytek Vigor 3912	['before v4.3.5.2']
Draytek Vigor 2925	['up to v3.9.6']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

References

http://draytek.com

https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946

CVSS Score

8.4 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: Feb. 27, 2025, 9:15 p.m.
Last Modified: Feb. 28, 2025, 10:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2024-41340