CVE-2024-41594: DrayTek VIGOR1000B Firmware
High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.
Affected products
- DrayTek VIGOR1000B Firmware: before 4.3.2.8 (fixed in 4.3.2.8); from 4.4.0.0, before 4.4.3.1 (fixed in 4.4.3.1)
- DrayTek VIGOR165 Firmware: before 4.2.7 (fixed in 4.2.7)
- DrayTek VIGOR166 Firmware: before 4.2.7 (fixed in 4.2.7)
- DrayTek VIGOR2133 Firmware: any version
- DrayTek VIGOR2135 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
- DrayTek VIGOR2620 Firmware: any version
- DrayTek VIGOR2762 Firmware: any version
- DrayTek VIGOR2763 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
- DrayTek VIGOR2765 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
- DrayTek VIGOR2766 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
- DrayTek VIGOR2832 Firmware: any version
- DrayTek VIGOR2860 Firmware: any version
- DrayTek VIGOR2862 Firmware: any version
- DrayTek VIGOR2865 Firmware: before 4.4.5.2 (fixed in 4.4.5.2)
- DrayTek VIGOR2866 Firmware: before 4.4.5.2 (fixed in 4.4.5.2)
- DrayTek VIGOR2915 Firmware: before 4.4.5.3 (fixed in 4.4.5.3)
- DrayTek VIGOR2925 Firmware: any version
- DrayTek VIGOR2926 Firmware: any version
- DrayTek VIGOR2952 Firmware: any version
- DrayTek VIGOR2962 Firmware: before 4.3.2.8 (fixed in 4.3.2.8); from 4.4.0.0, before 4.4.3.1 (fixed in 4.4.3.1)
- DrayTek VIGOR3220 Firmware: any version
- DrayTek VIGOR3910 Firmware: before 4.3.2.8 (fixed in 4.3.2.8); from 4.4.0.0, before 4.4.3.1 (fixed in 4.4.3.1)
- DrayTek VIGOR3912 Firmware: before 4.3.6.1 (fixed in 4.3.6.1)
- DrayTek VIGORLTE200 Firmware: any version
Published 2024-10-03. Last modified 2026-06-17.