CVE-2024-41339

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution.

• draytek vigor165 firmware (< 4.2.7) • draytek vigor166 firmware (< 4.2.7) • draytek vigor2620 firmware (< 3.9.8.9) • draytek vigorlte200 firmware (< 3.9.8.9) • draytek vigor2860 firmware (< 3.9.8) • draytek vigor2925 firmware (< 3.9.8) • draytek vigor2862 firmware (< 3.9.9.5) • draytek vigor2926 firmware (< 3.9.9.5) • draytek vigor2133 firmware (< 3.9.9) • draytek vigor2762 firmware (< 3.9.9) • draytek vigor2832 firmware (< 3.9.9) • draytek vigor2135 firmware (< 4.4.5.1) • draytek vigor2765 firmware (< 4.4.5.1) • draytek vigor2766 firmware (< 4.4.5.1) • draytek vigor2865 firmware (< 4.4.5.3) • draytek vigor2866 firmware (< 4.4.5.3) • draytek vigor2927 firmware (< 4.4.5.3) • draytek vigor2962 firmware (< 4.3.2.8) • draytek vigor2962 firmware 4.4.3.0 • draytek vigor3910 firmware (< 4.3.2.8) • draytek vigor3910 firmware 4.4.3 • draytek vigor3912 firmware (< 4.3.6.1)