PT-2025-9018 · Draytek · Draytek Vigor 3912+8

Published 2024-08-09 · Updated 2025-03-25 · CVE-2024-41334

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Draytek Vigor 165/166 versions prior to 4.2.6 Draytek Vigor 2620/LTE200 versions prior to 3.9.8.8 Draytek Vigor 2860/2925 versions prior to 3.9.7 Draytek Vigor 2862/2926 versions prior to 3.9.9.4 Draytek Vigor 2133/2762/2832 versions prior to 3.9.8 Draytek Vigor 2135/2765/2766 versions prior to 4.4.5.1 Draytek Vigor 2865/2866/2927 versions prior to 4.4.5.3 Draytek Vigor 2962/3910 versions prior to 4.3.2.7 Draytek Vigor 3912 versions prior to 4.3.5.2 Draytek Vigor 2925 versions up to 3.9.6

Description The issue allows attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution, as the devices do not utilize certificate verification.

Recommendations For Draytek Vigor 165/166 versions prior to 4.2.6, update to version 4.2.6 or later. For Draytek Vigor 2620/LTE200 versions prior to 3.9.8.8, update to version 3.9.8.8 or later. For Draytek Vigor 2860/2925 versions prior to 3.9.7, update to version 3.9.7 or later. For Draytek Vigor 2862/2926 versions prior to 3.9.9.4, update to version 3.9.9.4 or later. For Draytek Vigor 2133/2762/2832 versions prior to 3.9.8, update to version 3.9.8 or later. For Draytek Vigor 2135/2765/2766 versions prior to 4.4.5.1, update to version 4.4.5.1 or later. For Draytek Vigor 2865/2866/2927 versions prior to 4.4.5.3, update to version 4.4.5.3 or later. For Draytek Vigor 2962/3910 versions prior to 4.3.2.7, update to version 4.3.2.7 or later. For Draytek Vigor 3912 versions prior to 4.3.5.2, update to version 4.3.5.2 or later. For Draytek Vigor 2925 versions up to 3.9.6, update to version 3.9.7 or later.

Fix

Code Injection

Improper Certificate Validation

Weakness Enumeration

CWE-94

CWE-295

Related Identifiers

BDU:2025-04568

CVE-2024-41334

Affected Products

Draytek Vigor 165/166

Draytek Vigor 2133/2762/2832

Draytek Vigor 2135/2765/2766

Draytek Vigor 2620/Lte200

Draytek Vigor 2860/2925

Draytek Vigor 2862/2926

Draytek Vigor 2865/2866/2927

Draytek Vigor 2962/3910

Draytek Vigor 3912

References · 14

• https://bdu.fstec.ru/vul/2025-04568 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2025-04-09.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41334 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41334 · Vendor Advisory
• https://draytek.com/support/knowledge-base/4695 · Note
• https://twitter.com/fletch_ai/status/1898237374238540137 · Twitter Post
• https://twitter.com/GEN_NET_UK/status/1904478299490767127 · Twitter Post
• http://draytek.com · Note
• https://draytek.com/about/security-advisory/denial-of-service,-information-disclosure,-and-code-execution-vulnerabilities · Note
• https://t.me/cvedetector/19080 · Telegram Post
• https://twitter.com/cybercronai/status/1895798817443737998 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1897832277960483293 · Twitter Post
• https://t.me/cvenotify/112819 · Telegram Post
• https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946 · Note