CVE-2024-41336

High

Published: 27 February 2025

Published

27 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0013 32.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-41336 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability in Draytek (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-28 Protection of Information at Rest good match

prevent

Directly requires cryptographic mechanisms to protect confidentiality of sensitive information like plaintext passwords stored at rest on affected Draytek routers.

IA-5 Authenticator Management good match

prevent

Mandates protection of authenticator content, such as passwords, from unauthorized disclosure, directly addressing plaintext storage vulnerabilities.

SI-2 Flaw Remediation good match

prevent

Ensures identification, reporting, testing, and installation of firmware updates to remediate the specific plaintext password storage flaw in vulnerable Draytek Vigor models.

NVD Description

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910…

prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to store passwords in plaintext.

Deeper analysisAI

CVE-2024-41336 is a vulnerability involving the plaintext storage of passwords (CWE-256) in multiple Draytek Vigor router models. Affected devices include Vigor 165/166 prior to v4.2.6, Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows adversaries to obtain sensitive passwords stored in plaintext, potentially enabling further unauthorized access to the device, associated networks, or services protected by those credentials.

Mitigation involves upgrading affected Draytek Vigor devices to the specified patched firmware versions. Additional details are available in advisories from Draytek at http://draytek.com and Faraday Labs at https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946.