CVE-2024-41340: Malicious File Upload

Published Feb 27, 2025
·
Updated

An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.

Affected Software

62 affected components
DrayTek Vigor 165<4.2.6
DrayTek Vigor 166<4.2.6
DrayTek Vigor 2620<3.9.8.8
DrayTek LTE200<3.9.8.8
DrayTek Vigor 2860<3.9.7
DrayTek Vigor 2925<3.9.7, <=3.9.6
DrayTek Vigor 2862<3.9.9.4
DrayTek Vigor 2926<3.9.9.4
DrayTek Vigor 2133<3.9.8
DrayTek Vigor 2762<3.9.8
DrayTek Vigor 2832<3.9.8
DrayTek Vigor 2135<4.4.5.1
DrayTek Vigor 2765<4.4.5.1
DrayTek Vigor 2766<4.4.5.1
DrayTek Vigor 2865<4.4.5.3
DrayTek Vigor 2866<4.4.5.3
DrayTek Vigor 2927<4.4.5.3
DrayTek Vigor 2962<4.3.2.7
DrayTek Vigor 3910<4.3.2.7
DrayTek Vigor 3912<4.3.5.2
All of the following
DrayTek Vigor165 Firmware<4.2.7
DrayTek Vigor165
All of the following
DrayTek Vigor166 Firmware<4.2.7
DrayTek Vigor166
All of the following
DrayTek Vigor2620 Firmware<3.9.8.9
DrayTek Vigor2620
All of the following
DrayTek Vigorlte200 Firmware<3.9.8.9
DrayTek Vigorlte200
All of the following
DrayTek Vigor2860 Firmware<3.9.8
DrayTek Vigor2860
All of the following
DrayTek Vigor2925 Firmware<3.9.8
DrayTek Vigor2925
All of the following
DrayTek Vigor2862 Firmware<3.9.9.5
DrayTek Vigor2862
All of the following
DrayTek Vigor2926 Firmware<3.9.9.5
DrayTek Vigor2926
All of the following
DrayTek Vigor2133 Firmware<3.9.9
DrayTek Vigor2133
All of the following
DrayTek Vigor2762 Firmware<3.9.9
DrayTek Vigor2762
All of the following
DrayTek Vigor2832 Firmware<3.9.9
DrayTek Vigor2832
All of the following
DrayTek Vigor2135 Firmware<4.4.5.1
DrayTek Vigor2135
All of the following
DrayTek Vigor2765 Firmware<4.4.5.1
DrayTek Vigor2765
All of the following
DrayTek Vigor2766 Firmware<4.4.5.1
DrayTek Vigor2766
All of the following
DrayTek Vigor2865 Firmware<4.4.5.3
DrayTek Vigor2865
All of the following
DrayTek Vigor2866 Firmware<4.4.5.3
DrayTek Vigor2866
All of the following
DrayTek Vigor2927 Firmware<4.4.5.3
DrayTek Vigor2927
All of the following
Any of the following
DrayTek Vigor2962 Firmware<4.3.2.8
DrayTek Vigor2962 Firmware=4.4.3.0
DrayTek Vigor2962
All of the following
Any of the following
DrayTek Vigor3910 Firmware<4.3.2.8
DrayTek Vigor3910 Firmware=4.4.3
DrayTek Vigor3910
All of the following
DrayTek Vigor3912 Firmware<4.3.6.1
DrayTek Vigor3912

Event History

Feb 27, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-41340?

CVE-2024-41340 is classified as a high severity vulnerability affecting specific Draytek devices.

2

How do I fix CVE-2024-41340?

To mitigate CVE-2024-41340, update your Draytek device firmware to the latest version as listed in the advisory.

3

Which Draytek devices are affected by CVE-2024-41340?

CVE-2024-41340 affects multiple Draytek models including Vigor 165, 166, 2620, LTE200, and others prior to their respective fixed versions.

4

What type of vulnerability is CVE-2024-41340?

CVE-2024-41340 is a security vulnerability that can allow unauthorized access or exploitation of affected Draytek devices.

5

Is there a workaround for CVE-2024-41340?

While applying the firmware update is the recommended approach, temporarily restricting access to the affected Draytek devices may serve as a workaround.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203