CVE-2024-41336
Published: 27 February 2025
Summary
CVE-2024-41336 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability in Draytek (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 45.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest).
Deeper analysis
CVE-2024-41336 is a vulnerability involving the plaintext storage of passwords (CWE-256) in multiple Draytek Vigor router models. Affected devices include Vigor 165/166 prior to v4.2.6, Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows adversaries to obtain sensitive passwords stored in plaintext, potentially enabling further unauthorized access to the device, associated networks, or services protected by those credentials.
Mitigation involves upgrading affected Draytek Vigor devices to the specified patched firmware versions. Additional details are available in advisories from Draytek at http://draytek.com and Faraday Labs at https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5951
Vulnerability details
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910…
more
prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to store passwords in plaintext.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly exposes plaintext credentials in device storage, enabling T1552.001 (Credentials In Files) via unauthenticated remote access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic mechanisms to protect confidentiality of sensitive information like plaintext passwords stored at rest on affected Draytek routers.
Mandates protection of authenticator content, such as passwords, from unauthorized disclosure, directly addressing plaintext storage vulnerabilities.
Ensures identification, reporting, testing, and installation of firmware updates to remediate the specific plaintext password storage flaw in vulnerable Draytek Vigor models.