CVE-2024-41335 Overview
CVE-2024-41335 affects multiple DrayTek Vigor router models that use insecure versions of the strcmp and memcmp functions. These functions perform comparisons in non-constant time, allowing remote attackers to extract sensitive information through timing analysis. The flaw is classified under [CWE-203] (Observable Discrepancy) and impacts authentication or secret comparison routines within the device firmware. Attackers on the network can measure response time variations to infer secret values byte by byte. Successful exploitation may disclose credentials or other confidential data processed by the affected routers.
Critical Impact
Network-based attackers can recover sensitive information from DrayTek Vigor routers by measuring timing differences in string comparison operations, leading to confidentiality compromise.
Affected Products
- DrayTek Vigor 165/166 prior to v4.2.6, Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7
- DrayTek Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1
- DrayTek Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6
Discovery Timeline
- 2025-02-27 - CVE-2024-41335 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-41335
Vulnerability Analysis
The affected DrayTek Vigor firmware uses the standard library functions strcmp and memcmp to compare secret values such as passwords, tokens, or cryptographic material. Both functions return as soon as the first differing byte is encountered. This early-exit behavior creates a measurable timing side channel.
An attacker submits candidate values to the router and measures the response time for each request. Longer processing times indicate a greater number of correctly matched leading bytes. By iterating through one byte at a time, the attacker reconstructs the secret without ever needing to guess the full value.
The vulnerability is exploitable over the network without authentication or user interaction. Because the timing leak operates on secret comparison paths, repeated probing can lead to disclosure of sensitive material used in administrative or cryptographic operations.
Root Cause
The root cause is the use of non-constant-time comparison functions on security-sensitive data. Constant-time comparison routines, which always examine every byte regardless of mismatch, are the standard mitigation. The affected firmware did not adopt constant-time comparisons in the relevant code paths.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. The attacker needs network reachability to the affected router service and the ability to measure round-trip times with sufficient precision to distinguish nanosecond-level differences across many samples.
No verified exploitation code is publicly available. Refer to the Medium Advisory on DrayTek Vulnerabilities for additional technical context.
Detection Methods for CVE-2024-41335
Indicators of Compromise
- High volumes of authentication or management interface requests from a single source over short time windows.
- Repeated requests that differ only by small variations in submitted credentials or tokens.
- Unusual patterns of failed authentication attempts targeting administrative services on the router.
Detection Strategies
- Monitor router management interfaces for sustained probing activity that suggests timing measurement campaigns.
- Inspect network telemetry for repetitive request patterns directed at login or token validation endpoints.
- Correlate firmware version information against the vulnerable version list to identify exposed devices.
Monitoring Recommendations
- Enable logging on all DrayTek management interfaces and forward logs to a centralized analytics platform.
- Alert on authentication endpoint request rates that exceed established baselines for each device.
- Track outbound connections from router management subnets for signs of post-exploitation reconnaissance.
How to Mitigate CVE-2024-41335
Immediate Actions Required
- Identify all DrayTek Vigor devices in the environment and confirm firmware versions against the affected list.
- Restrict management interface exposure to trusted internal networks and remove any public-facing administrative access.
- Apply the vendor-supplied firmware update for the corresponding model as soon as feasible.
Patch Information
DrayTek has released fixed firmware versions: Vigor 165/166 v4.2.6, Vigor 2620/LTE200 v3.9.8.8, Vigor 2860/2925 v3.9.7, Vigor 2862/2926 v3.9.9.4, Vigor 2133/2762/2832 v3.9.8, Vigor 2135/2765/2766 v4.4.5.1, Vigor 2865/2866/2927 v4.4.5.3, Vigor 2962/3910 v4.3.2.7, and Vigor 3912 v4.3.5.2. Refer to the DrayTek Official Site for firmware downloads and release notes.
Workarounds
- Disable remote administration on the WAN interface and require management traffic to traverse a VPN.
- Apply access control lists that limit management service connections to specific administrative source addresses.
- Rotate any credentials or shared secrets that may have been processed by the affected devices after patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
