Arbitrary Code Execution Vulnerability in Draytek Vigor Routers
CVE-2024-41339

8.8HIGH

Key Information:

Vendor

Draytek
Status
Vigor Routers
Vendor
CVE Published:
27 February 2025

What is CVE-2024-41339?

A vulnerability in the CGI endpoint of several Draytek Vigor routers allows attackers to upload a specially crafted kernel module. This security flaw enables potential arbitrary code execution, compromising the integrity and security of the affected devices. Vulnerable device versions include multiple routers from the Vigor series, creating significant risks for users who have not updated to the recommended firmware.

References

http://draytek.com
https://medium.com/faraday/advisory-multiple-vulnerabilit...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2024-41339 : Arbitrary Code Execution Vulnerability in Draytek Vigor Routers