CVE-2024-41339

🗓️ 27 Feb 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 150 Views🌐 WEB

Issue in CGI endpoint of Draytek devices allows arbitrary code execution via kernel module upload.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-41339	27 Feb 202521:35	–	circl
CNNVD	DrayTek Vigor 165: Code Injection Vulnerability	27 Feb 202500:00	–	cnnvd
Cvelist	CVE-2024-41339	27 Feb 202500:00	–	cvelist
EUVD	EUVD-2025-5950	3 Oct 202520:07	–	euvd
NVD	CVE-2024-41339	27 Feb 202521:15	–	nvd
osv_cve	CVE-2024-41339	27 Feb 202521:15	–	osv_cve
Positive Technologies	PT-2025-9022	27 Feb 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-41339: Unrestricted Upload of File with Dangerous Type	27 Feb 202500:00	–	rapid7
RedhatCVE	CVE-2024-41339	9 Jan 202609:33	–	redhatcve
Vulnrichment	CVE-2024-41339	27 Feb 202500:00	–	vulnrichment

NVD

Node

AND

draytek vigor165_firmwareRange<4.2.7

draytek vigor165Match-

Node

AND

draytek vigor166_firmwareRange<4.2.7

draytek vigor166Match-

Node

AND

draytek vigor2620_firmwareRange<3.9.8.9

draytek vigor2620Match-

Node

AND

draytek vigorlte200_firmwareRange<3.9.8.9

draytek vigorlte200Match-

Node

AND

draytek vigor2860_firmwareRange<3.9.8

draytek vigor2860Match-

Node

AND

draytek vigor2925_firmwareRange<3.9.8

draytek vigor2925Match-

Node

AND

draytek vigor2862_firmwareRange<3.9.9.5

draytek vigor2862Match-

Node

AND

draytek vigor2926_firmwareRange<3.9.9.5

draytek vigor2926Match-

Node

AND

draytek vigor2133_firmwareRange<3.9.9

draytek vigor2133Match-

Node

AND

draytek vigor2762_firmwareRange<3.9.9

draytek vigor2762Match-

Node

AND

draytek vigor2832_firmwareRange<3.9.9

draytek vigor2832Match-

Node

AND

draytek vigor2135_firmwareRange<4.4.5.1

draytek vigor2135Match-

Node

AND

draytek vigor2765_firmwareRange<4.4.5.1

draytek vigor2765Match-

Node

AND

draytek vigor2766_firmwareRange<4.4.5.1

draytek vigor2766Match-

Node

AND

draytek vigor2865_firmwareRange<4.4.5.3

draytek vigor2865Match-

Node

AND

draytek vigor2866_firmwareRange<4.4.5.3

draytek vigor2866Match-

Node

AND

draytek vigor2927_firmwareRange<4.4.5.3

draytek vigor2927Match-

Node

AND

OR

draytek vigor2962_firmwareRange<4.3.2.8

draytek vigor2962_firmwareMatch4.4.3.0

draytek vigor2962Match-

Node

AND

OR

draytek vigor3910_firmwareRange<4.3.2.8

draytek vigor3910_firmwareMatch4.4.3

draytek vigor3910Match-

Node

AND

draytek vigor3912_firmwareRange<4.3.6.1

draytek vigor3912Match-

Source	Link
medium	www.medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946

Parameter	Position	Path	Description	CWE
config_file	request body	/cgi-bin/upload_config.cgi	The CGI endpoint used to upload configurations allows an attacker to upload a crafted kernel module, leading to arbitrary code execution.	CWE-434

05 Jul 2026 01:20Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.8

EPSS0.00646

SSVC

cve 2024 41339 draytek devices arbitrary code execution