CVE-2024-41340
Last modified
CVE-2024-41340 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Draytek | Vigor165 Firmware | < 4.2.7 |
| Draytek | Vigor166 Firmware | < 4.2.7 |
| Draytek | Vigor2620 Firmware | < 3.9.8.9 |
| Draytek | Vigorlte200 Firmware | < 3.9.8.9 |
| Draytek | Vigor2860 Firmware | < 3.9.8 |
| Draytek | Vigor2925 Firmware | < 3.9.8 |
| Draytek | Vigor2862 Firmware | < 3.9.9.5 |
| Draytek | Vigor2926 Firmware | < 3.9.9.5 |
| Draytek | Vigor2133 Firmware | < 3.9.9 |
| Draytek | Vigor2762 Firmware | < 3.9.9 |
| Draytek | Vigor2832 Firmware | < 3.9.9 |
| Draytek | Vigor2135 Firmware | < 4.4.5.1 |
| Draytek | Vigor2765 Firmware | < 4.4.5.1 |
| Draytek | Vigor2766 Firmware | < 4.4.5.1 |
| Draytek | Vigor2865 Firmware | < 4.4.5.3 |
| Draytek | Vigor2866 Firmware | < 4.4.5.3 |
| Draytek | Vigor2927 Firmware | < 4.4.5.3 |
| Draytek | Vigor2962 Firmware | < 4.3.2.8 |
| Draytek | Vigor2962 Firmware | 4.4.3.0 |
| Draytek | Vigor3910 Firmware | < 4.3.2.8 |
| Draytek | Vigor3910 Firmware | 4.4.3 |
| Draytek | Vigor3912 Firmware | < 4.3.6.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-41340?
How severe is CVE-2024-41340?
How do I fix CVE-2024-41340?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-41333A reflected cross-site scripting (XSS) vulnerability in Phpg…6.1
- CVE-2024-41334Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/L…8.8
- CVE-2024-41335Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/L…7.5
- CVE-2024-41336Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/L…7.5
- CVE-2024-41338A NULL pointer dereference in Draytek devices Vigor 165/166 …7.5
- CVE-2024-41339An issue in the CGI endpoint used to upload configurations i…8.8
- CVE-2024-41344A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 al…7.5
- CVE-2024-41345openflights commit 5234b5b is vulnerable to Cross-Site Scrip…5.4
- CVE-2024-41346openflights commit 5234b5b is vulnerable to Cross-Site Scrip…5.4
- CVE-2024-41347openflights commit 5234b5b is vulnerable to Cross-Site Scrip…6.1
- CVE-2024-41348openflights commit 5234b5b is vulnerable to Cross-Site Scrip…6.1
- CVE-2024-41349unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via…6.1
Are you affected by CVE-2024-41340?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST