CVE-2024-41334: DrayTek VIGOR165 Firmware

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to not utilize certificate verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution.

Affected products

DrayTek VIGOR165 Firmware: before 4.2.6 (fixed in 4.2.6)
DrayTek VIGOR166 Firmware: before 4.2.6 (fixed in 4.2.6)
DrayTek VIGOR2133 Firmware: before 3.9.8 (fixed in 3.9.8)
DrayTek VIGOR2135 Firmware: before 4.4.5.1 (fixed in 4.4.5.1)
DrayTek VIGOR2620 Firmware: before 3.9.8.8 (fixed in 3.9.8.8)
DrayTek VIGOR2762 Firmware: before 3.9.8 (fixed in 3.9.8)
DrayTek VIGOR2765 Firmware: before 4.4.5.1 (fixed in 4.4.5.1)
DrayTek VIGOR2766 Firmware: before 4.4.5.1 (fixed in 4.4.5.1)
DrayTek VIGOR2832 Firmware: before 3.9.8 (fixed in 3.9.8)
DrayTek VIGOR2860 Firmware: before 3.9.7 (fixed in 3.9.7)
DrayTek VIGOR2862 Firmware: before 3.9.9.4 (fixed in 3.9.9.4)
DrayTek VIGOR2865 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
DrayTek VIGOR2866 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
DrayTek VIGOR2925 Firmware: before 3.9.7 (fixed in 3.9.7)
DrayTek VIGOR2926 Firmware: before 3.9.9.4 (fixed in 3.9.9.4)
DrayTek VIGOR2927 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
DrayTek VIGOR2962 Firmware: before 4.3.2.7 (fixed in 4.3.2.7)
DrayTek VIGOR3910 Firmware: before 4.3.2.7 (fixed in 4.3.2.7)
DrayTek VIGOR3912 Firmware: before 4.3.5.2 (fixed in 4.3.5.2)
DrayTek VIGORLTE200 Firmware: before 3.9.8.8 (fixed in 3.9.8.8)

Published 2025-02-27. Last modified 2026-07-05.