CVE-2024-41340
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.
- Score
- CVSS 3.1 8.4 High
- Status
- Modified - cve@mitre.org
- Published
- 2025-02-27
- Last modified
- 2026-07-05
- Weaknesses
- CWE-434
Affected products
- Vigor165 Firmware (Draytek)
- Vigor166 Firmware (Draytek)
- Vigor2133 Firmware (Draytek)
- Vigor2135 Firmware (Draytek)
- Vigor2620 Firmware (Draytek)
- Vigor2762 Firmware (Draytek)
- Vigor2765 Firmware (Draytek)
- Vigor2766 Firmware (Draytek)
- Vigor2832 Firmware (Draytek)
- Vigor2860 Firmware (Draytek)
- Vigor2862 Firmware (Draytek)
- Vigor2865 Firmware (Draytek)
- Vigor2866 Firmware (Draytek)
- Vigor2925 Firmware (Draytek)
- Vigor2926 Firmware (Draytek)
- Vigor2927 Firmware (Draytek)
- Vigor2962 Firmware (Draytek)
- Vigor3910 Firmware (Draytek)
- Vigor3912 Firmware (Draytek)
- Vigorlte200 Firmware (Draytek)
References
- https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
