CVE-2024-41340
Published: 27 February 2025
Summary
CVE-2024-41340 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Draytek Vigor2962 Firmware. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-41340 is an unrestricted file upload vulnerability (CWE-434) affecting multiple Draytek Vigor router models, including Vigor 165/166 prior to v4.2.6, Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6. The flaw enables attackers to upload crafted APP Enforcement modules, resulting in arbitrary code execution on the device.
The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by local attackers with low complexity, no privileges, and no user interaction required. Successful exploitation grants high-impact arbitrary code execution, potentially allowing full compromise of the router's confidentiality, integrity, and availability.
Advisories from Draytek (http://draytek.com) and a Faraday Labs report (https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946) recommend updating to the specified patched firmware versions for each affected model to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5923
Vulnerability details
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to…
more
v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload on router management interface directly enables remote/local exploitation of public-facing app (T1190) and malicious module ingress for code execution (T1105).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of uploaded APP Enforcement modules to reject crafted files that could lead to arbitrary code execution.
Requires timely patching of the unrestricted file upload flaw via updated firmware versions recommended by Draytek.
Mandates digital signatures for system components like APP Enforcement modules, blocking unsigned crafted uploads from execution.