CVE-2024-41335: High severity DrayTek Vigor 165 vulnerability
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to utilize insecure versions of the functions strcmp and memcmp, allowing attackers to possibly obtain sensitive information via timing attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Draytek Vigor 165/166to a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
Draytek Vigor 2620/LTE200to a version that resolves this vulnerability.Fixed in 3.9.8.8 - Upgrade
Upgrade
Draytek Vigor 2860/2925to a version that resolves this vulnerability.Fixed in 3.9.7 - Upgrade
Upgrade
Draytek Vigor 2862/2926to a version that resolves this vulnerability.Fixed in 3.9.9.4 - Upgrade
Upgrade
Draytek Vigor 2133/2762/2832to a version that resolves this vulnerability.Fixed in 3.9.8 - Upgrade
Upgrade
Draytek Vigor 2135/2765/2766to a version that resolves this vulnerability.Fixed in 4.4.5.1 - Upgrade
Upgrade
Draytek Vigor 2865/2866/2927to a version that resolves this vulnerability.Fixed in 4.4.5.3 - Upgrade
Upgrade
Draytek Vigor 2962/3910to a version that resolves this vulnerability.Fixed in 4.3.2.7 - Upgrade
Upgrade
Draytek Vigor 3912to a version that resolves this vulnerability.Fixed in 4.3.5.2 - Upgrade
Upgrade
Draytek Vigor 2925to a version that resolves this vulnerability.Fixed in 3.9.6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41335?
CVE-2024-41335 has been classified with a severity level that varies based on the specific Draytek device affected.
How do I fix CVE-2024-41335?
To address CVE-2024-41335, users should update their Draytek devices to the latest firmware version as specified in the vendor recommendations.
Which Draytek devices are affected by CVE-2024-41335?
CVE-2024-41335 affects several Draytek devices including Vigor 165, 166, 2620, LTE200, 2860, 2925, and more, listed with their respective version requirements.
How can I verify if my Draytek device is vulnerable to CVE-2024-41335?
Users can check the firmware version of their Draytek device against the version requirements outlined for CVE-2024-41335 to determine vulnerability.
What kind of attacks does CVE-2024-41335 facilitate?
CVE-2024-41335 could potentially allow unauthorized access or manipulation of the affected Draytek devices, posing security risks.