CVE-2024-41334

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to not utilize certificate verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution.

• draytek vigor166 firmware (< 4.2.6) • draytek vigor2620 firmware (< 3.9.8.8) • draytek vigorlte200 firmware (< 3.9.8.8) • draytek vigor2860 firmware (< 3.9.7) • draytek vigor2925 firmware (< 3.9.7) • draytek vigor2862 firmware (< 3.9.9.4) • draytek vigor2926 firmware (< 3.9.9.4) • draytek vigor2133 firmware (< 3.9.8) • draytek vigor2762 firmware (< 3.9.8) • draytek vigor2832 firmware (< 3.9.8) • draytek vigor2135 firmware (< 4.4.5.1) • draytek vigor2765 firmware (< 4.4.5.1) • draytek vigor2766 firmware (< 4.4.5.1) • draytek vigor2865 firmware (< 4.4.5.3) • draytek vigor2866 firmware (< 4.4.5.3) • draytek vigor2927 firmware (< 4.4.5.3) • draytek vigor2962 firmware (< 4.3.2.7) • draytek vigor3910 firmware (< 4.3.2.7) • draytek vigor3912 firmware (< 4.3.5.2) • draytek vigor165 firmware (< 4.2.6)