CVE-2024-41338
Memory Safety in Draytek Vigor165 Firmware ≤ 4.2.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2024-41338 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Draytek Vigor165 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-41338 is a NULL pointer dereference vulnerability (CWE-476) affecting multiple Draytek Vigor router models running firmware versions prior to specified patches, including Vigor 165/166 before v4.2.6, Vigor 2620/LTE200 before v3.9.8.8, Vigor 2860/2925 before v3.9.7, Vigor 2862/2926 before v3.9.9.4, Vigor 2133/2762/2832 before v3.9.8, Vigor 2135/2765/2766 before v4.4.5.1, Vigor 2865/2866/2927 before v4.4.5.3, Vigor 2962/3910 before v4.3.2.7, Vigor 3912 before v4.3.5.2, and Vigor 2925 up to v3.9.6. The issue occurs in the processing of DHCP requests, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The vulnerability can be exploited by unauthenticated attackers with network access, requiring low complexity and no user interaction. By sending a specially crafted DHCP request to the device, an attacker can trigger the NULL pointer dereference, causing a Denial of Service that disrupts device availability, such as crashing the router and halting network services.
Advisories recommend updating affected Draytek Vigor devices to the patched firmware versions listed in the CVE description or later. Further details on mitigations and patches are available from the vendor at http://draytek.com and the Faraday security advisory at https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5967
Vulnerability Data
A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927…
more
prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including static analysis) directly finds null-dereference bugs before deployment.
Documented development standards and tools can enforce null-safety rules and safe pointer usage.
Engineering principles can mandate defensive coding such as explicit null checks before dereference.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect NULL dereference defects before release.
Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.
Application security requirements can specify input validation and pointer-safety rules.
Secure architecture principles encourage defensive design that avoids unsafe pointer use.
Secure coding standards directly require NULL-pointer checks and safe dereference patterns.