CVE-2024-41594

Oct. 8, 2024, 3:31 p.m.

7.5
High

Description

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.

Product(s) Impacted

Vendor Product Versions
Draytek
  • Vigor2620 Firmware
  • Vigor2620
  • Vigor2915 Firmware
  • Vigor2915
  • Vigor2866 Firmware
  • Vigor2866
  • Vigor2766 Firmware
  • Vigor2766
  • Vigor2865 Firmware
  • Vigor2865
  • Vigor2765 Firmware
  • Vigor2765
  • Vigor2763 Firmware
  • Vigor2763
  • Vigor2135 Firmware
  • Vigor2135
  • Vigor166 Firmware
  • Vigor166
  • Vigor1000b Firmware
  • Vigor1000b
  • Vigor165 Firmware
  • Vigor165
  • Vigor3910 Firmware
  • Vigor3910
  • Vigor2962 Firmware
  • Vigor2962
  • Vigor3912 Firmware
  • Vigor3912
  • Vigorlte200 Firmware
  • Vigorlte200
  • Vigor2133 Firmware
  • Vigor2133
  • Vigor2762 Firmware
  • Vigor2762
  • Vigor2832 Firmware
  • Vigor2832
  • Vigor2860 Firmware
  • Vigor2860
  • Vigor2862 Firmware
  • Vigor2862
  • Vigor2925 Firmware
  • Vigor2925
  • Vigor2926 Firmware
  • Vigor2926
  • Vigor2952 Firmware
  • Vigor2952
  • Vigor3220 Firmware
  • Vigor3220
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -
  • *
  • -

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-326
Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
o draytek vigor2620_firmware / / / / / / / /
h draytek vigor2620 - / / / / / / /
o draytek vigor2915_firmware / / / / / / / /
h draytek vigor2915 - / / / / / / /
o draytek vigor2866_firmware / / / / / / / /
h draytek vigor2866 - / / / / / / /
o draytek vigor2766_firmware / / / / / / / /
h draytek vigor2766 - / / / / / / /
o draytek vigor2865_firmware / / / / / / / /
h draytek vigor2865 - / / / / / / /
o draytek vigor2765_firmware / / / / / / / /
h draytek vigor2765 - / / / / / / /
o draytek vigor2763_firmware / / / / / / / /
h draytek vigor2763 - / / / / / / /
o draytek vigor2135_firmware / / / / / / / /
h draytek vigor2135 - / / / / / / /
o draytek vigor166_firmware / / / / / / / /
h draytek vigor166 - / / / / / / /
o draytek vigor1000b_firmware / / / / / / / /
o draytek vigor1000b_firmware / / / / / / / /
h draytek vigor1000b - / / / / / / /
o draytek vigor165_firmware / / / / / / / /
h draytek vigor165 - / / / / / / /
o draytek vigor3910_firmware / / / / / / / /
o draytek vigor3910_firmware / / / / / / / /
h draytek vigor3910 - / / / / / / /
o draytek vigor2962_firmware / / / / / / / /
o draytek vigor2962_firmware / / / / / / / /
h draytek vigor2962 - / / / / / / /
o draytek vigor3912_firmware / / / / / / / /
h draytek vigor3912 - / / / / / / /
o draytek vigorlte200_firmware / / / / / / / /
h draytek vigorlte200 - / / / / / / /
o draytek vigor2133_firmware / / / / / / / /
h draytek vigor2133 - / / / / / / /
o draytek vigor2762_firmware / / / / / / / /
h draytek vigor2762 - / / / / / / /
o draytek vigor2832_firmware / / / / / / / /
h draytek vigor2832 - / / / / / / /
o draytek vigor2860_firmware / / / / / / / /
h draytek vigor2860 - / / / / / / /
o draytek vigor2862_firmware / / / / / / / /
h draytek vigor2862 - / / / / / / /
o draytek vigor2925_firmware / / / / / / / /
h draytek vigor2925 - / / / / / / /
o draytek vigor2926_firmware / / / / / / / /
h draytek vigor2926 - / / / / / / /
o draytek vigor2952_firmware / / / / / / / /
h draytek vigor2952 - / / / / / / /
o draytek vigor3220_firmware / / / / / / / /
h draytek vigor3220 - / / / / / / /

References

https://www.forescout.com/resources/draybreak-draytek-research/
https://www.forescout.com/resources/draytek14-vulnerabilities

Tags

cve@mitre.org
CWE-326
2024-10-03
CVE-2024-41594

CVSS Score

7.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: Oct. 3, 2024, 7:15 p.m.
Last Modified: Oct. 8, 2024, 3:31 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.