CVEvulnerability

CVE-2024-41594

7.5 HIGH Published 2024-10-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-10-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326

Description

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.

Affected configurations

• draytek vigor2620 firmware • draytek vigor2915 firmware (< 4.4.5.3) • draytek vigor2866 firmware (< 4.4.5.2) • draytek vigor2766 firmware (< 4.4.5.3) • draytek vigor2865 firmware (< 4.4.5.2) • draytek vigor2765 firmware (< 4.4.5.3) • draytek vigor2763 firmware (< 4.4.5.3) • draytek vigor2135 firmware (< 4.4.5.3) • draytek vigor166 firmware (< 4.2.7) • draytek vigor1000b firmware (< 4.3.2.8) • draytek vigor1000b firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor165 firmware (< 4.2.7) • draytek vigor3910 firmware (< 4.3.2.8) • draytek vigor3910 firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor2962 firmware (< 4.3.2.8) • draytek vigor2962 firmware (>= 4.4.0.0 < 4.4.3.1) • draytek vigor3912 firmware (< 4.3.6.1) • draytek vigorlte200 firmware • draytek vigor2133 firmware • draytek vigor2762 firmware • draytek vigor2832 firmware • draytek vigor2860 firmware • draytek vigor2862 firmware • draytek vigor2925 firmware • draytek vigor2926 firmware • draytek vigor2952 firmware • draytek vigor3220 firmware

Related

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References