CVE-2024-23721 Overview
CVE-2024-23721 is a directory traversal vulnerability in the process_post function on DrayTek Vigor3910 routers running firmware version 4.3.2.5. An unauthenticated remote attacker can send a crafted POST request that triggers the vulnerable function and exports sensitive information from the device. The flaw is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
Remote, unauthenticated attackers can read sensitive files from affected Vigor3910 devices over the network without user interaction.
Affected Products
- DrayTek Vigor3910 hardware appliance
- DrayTek Vigor3910 firmware version 4.3.2.5
- Deployments exposing the management interface to untrusted networks
Discovery Timeline
- 2024-03-20 - CVE-2024-23721 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23721
Vulnerability Analysis
The vulnerability resides in the process_post handler within the Vigor3910 web management interface. The handler accepts POST data and processes file path parameters without enforcing canonical path validation. Supplying traversal sequences such as ../ allows the request to escape the intended directory and reference arbitrary files on the device filesystem. The handler then exports the referenced content back to the requester, resulting in information disclosure.
The weakness aligns with [CWE-22], where user-supplied input is concatenated into a file path before being passed to underlying file operations. Because the affected endpoint is reachable over the network and requires no authentication, exploitation requires only the ability to send HTTP POST requests to the management service. The current EPSS probability is 0.852% with a percentile of 53.6, indicating moderate exploitation likelihood relative to the broader CVE population.
Root Cause
The process_post routine fails to sanitize or normalize path components before opening files. Directory traversal sequences are accepted verbatim, allowing references outside the intended export directory. No allowlist of valid filenames or path prefixes is enforced.
Attack Vector
An attacker sends a specially crafted POST request to the affected endpoint on the Vigor3910 web interface. The request body contains a path parameter populated with traversal sequences pointing to a target file. The device processes the request, opens the referenced file, and returns its contents in the response. Technical reproduction details are documented in the public GitHub Gist Code Snippet referenced in the NVD entry.
// No verified exploit code is published in vendor or NVD sources.
// Refer to the linked GitHub Gist for technical reproduction details.
Detection Methods for CVE-2024-23721
Indicators of Compromise
- Inbound HTTP POST requests to the Vigor3910 management interface containing ../ or URL-encoded %2e%2e%2f sequences in body parameters
- Anomalous outbound responses from the router containing configuration data, credentials, or system file content
- Repeated POST requests from a single source enumerating filesystem paths
Detection Strategies
- Inspect web server and router access logs for POST requests with path traversal patterns in body parameters
- Deploy network IDS signatures that flag directory traversal payloads targeting DrayTek management endpoints
- Correlate management-plane requests originating from untrusted source IP ranges with successful HTTP 200 responses of unusual size
Monitoring Recommendations
- Forward router access and authentication logs to a centralized log management or SIEM platform for retention and correlation
- Alert on management interface access from IP addresses outside approved administrative ranges
- Baseline normal POST request sizes to the management interface and alert on outliers
How to Mitigate CVE-2024-23721
Immediate Actions Required
- Restrict access to the Vigor3910 web management interface to trusted administrative networks using ACLs or firewall rules
- Disable remote WAN-side management unless explicitly required
- Audit recent access logs for POST requests containing traversal sequences and investigate matching sources
- Rotate credentials and secrets that may have been exposed through filesystem disclosure
Patch Information
No vendor advisory URL is listed in the NVD entry for CVE-2024-23721. Administrators should consult the DrayTek Official Website for firmware updates beyond version 4.3.2.5 and apply the latest stable release for the Vigor3910 platform.
Workarounds
- Place the Vigor3910 management interface behind a VPN and block direct internet exposure of HTTP/HTTPS management ports
- Apply source IP allowlisting on the management service to limit access to specific administrator hosts
- Monitor for and block requests containing ../, ..\, or encoded equivalents at an upstream web application firewall
# Example: restrict management access to a trusted admin subnet
# (apply equivalent configuration in the Vigor3910 ACL settings)
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
