Arbitrary Code Execution Vulnerability in Draytek Vigor Routers
CVE-2024-41339

9.8CRITICAL

Key Information:

Vendor
Draytek
Status
Vigor Routers
Vendor
CVE Published:
27 February 2025

Summary

A vulnerability in the CGI endpoint of several Draytek Vigor routers allows attackers to upload a specially crafted kernel module. This security flaw enables potential arbitrary code execution, compromising the integrity and security of the affected devices. Vulnerable device versions include multiple routers from the Vigor series, creating significant risks for users who have not updated to the recommended firmware.

References

http://draytek.com
https://medium.com/faraday/advisory-multiple-vulnerabilit...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.