PT-2024-7435 · Draytek · Draytek Vigor 3910

Published 2024-10-02 · Updated 2024-10-04 · CVE-2024-41584

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 versions 4.3.2.6 and earlier

Description: The issue is caused by a reflected XSS vulnerability due to missing validation of the sFormAuthStr parameter. This allows authenticated users to conduct cross-site scripting attacks. The vulnerability exists in the wlogin.cgi script of the web interface of DrayTek Vigor3910 devices, which fails to protect the structure of web pages, enabling remote attackers to perform inter-site scripting attacks.

Recommendations: For DrayTek Vigor3910 versions 4.3.2.6 and earlier, as a temporary workaround, consider disabling the wlogin.cgi script until a patch is available. Restrict access to the vulnerable sFormAuthStr parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-08813

CVE-2024-41584

Affected Products

Draytek Vigor 3910

References · 9

• https://osv.dev/vulnerability/CVE-2024-41584 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08813 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41584 · Security Note
• https://forescout.com/resources/draytek14-vulnerabilities · Note
• https://twitter.com/VulmonFeeds/status/1841945143865168071 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024100306 · Note
• https://twitter.com/CVEnew/status/1841912370735505486 · Twitter Post
• https://t.me/cvedetector/6923 · Telegram Post
• https://forescout.com/resources/draybreak-draytek-research · Note