DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escape from the emulated instance and inject arbitrary commands into the host machine.
References
| Link | Resource |
|---|---|
| https://www.forescout.com/resources/draybreak-draytek-research/ | Third Party Advisory |
| https://www.forescout.com/resources/draytek14-vulnerabilities | Broken Link |
Configurations
Configuration 1 (hide)
| AND |
|
History
10 Apr 2025, 13:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.forescout.com/resources/draybreak-draytek-research/ - Third Party Advisory | |
| References | () https://www.forescout.com/resources/draytek14-vulnerabilities - Broken Link | |
| CPE | cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:* |
|
| First Time |
Draytek
Draytek vigor3910 Draytek vigor3910 Firmware |
Information
Published : 2024-10-03 19:15
Updated : 2025-04-10 13:41
NVD link : CVE-2024-41585
Mitre link : CVE-2024-41585
CVE.ORG link : CVE-2024-41585
JSON object : View
Products Affected
draytek
- vigor3910
- vigor3910_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')