PT-2024-20034 · Draytek · Draytek Vigor 3910

Published 2024-03-20 · Updated 2025-05-23 · CVE-2024-23721

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Draytek Vigor3910 version 4.3.2.5

Description A Directory Traversal issue was discovered in the process post function. When sending a certain POST request, it calls the function and exports information.

Recommendations For Draytek Vigor3910 version 4.3.2.5, consider restricting access to the process post function until a patch is available. Avoid sending specific POST requests that may trigger the Directory Traversal issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-23721

Affected Products

Draytek Vigor 3910

References · 6

• https://osv.dev/vulnerability/CVE-2024-23721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23721 · Security Note
• https://t.me/cvenotify/123455 · Telegram Post
• https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 · Note
• https://draytek.com · Note
• https://t.me/cvenotify/74290 · Telegram Post