PT-2024-7432 · Draytek · Draytek Vigor310

Published

2024-10-02

·

Updated

2025-04-10

·

CVE-2024-41589

CVSS v3.1

8.8

High

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 devices through 4.3.2.6
Description: The issue is related to shortcomings in the authentication procedure of DrayTek Vigor router software. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The devices use unencrypted HTTP for authentication requests.
Recommendations: For DrayTek Vigor310 devices through 4.3.2.6, consider disabling the use of unencrypted HTTP for authentication requests until a patch is available. Restrict access to authentication endpoints to minimize the risk of exploitation. Avoid using unencrypted HTTP for sensitive transactions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-255CWE-287

Related Identifiers

BDU:2024-08810
CVE-2024-41589

Affected Products

Draytek Vigor310