DrayTek Vigor310 Devices Vulnerable to Information Theft Due to Static String in PRNG of OpenSSL

CVE-2024-41594

Summary

A vulnerability exists in DrayTek Vigor310 devices, specifically within the management UI’s httpd server, which employs a static string for pseudo-random number generator (PRNG) seeding in OpenSSL. This flawed implementation allows attackers to exploit the vulnerability to access sensitive information that should otherwise remain protected, resulting in a significant security risk for users relying on these devices for secure network communications.

References