CVE-2024-41336: DrayTek Router Information Disclosure

CVE-2024-41336 Overview

CVE-2024-41336 affects multiple DrayTek Vigor router models that store user passwords in plaintext on the device. The flaw maps to [CWE-256] Plaintext Storage of a Password. An attacker with network access who obtains a configuration file or backup can read credentials directly. The issue spans the Vigor 165/166, 2620/LTE200, 2860/2925, 2862/2926, 2133/2762/2832, 2135/2765/2766, 2865/2866/2927, 2962/3910, and 3912 product lines across multiple firmware versions.

Critical Impact
Stored credentials are recoverable in cleartext from affected DrayTek Vigor devices, enabling account takeover and lateral movement across the network perimeter.

Affected Products

DrayTek Vigor 165/166 prior to v4.2.6, Vigor 2620/LTE200 prior to v3.9.8.8
DrayTek Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8
DrayTek Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6

Discovery Timeline

2025-02-27 - CVE-2024-41336 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-41336

Vulnerability Analysis

The affected DrayTek Vigor firmware persists administrative and user passwords as cleartext within device storage. The weakness is classified under [CWE-256] Plaintext Storage of a Password. Anyone who reads the configuration, a configuration backup, or the underlying storage region recovers the original credentials without cracking. This eliminates the protection that hashing or encryption would otherwise provide against credential exposure.

The network attack vector means exposure scales with any flaw or misconfiguration that exposes configuration data. Examples include configuration export endpoints, TR-069 provisioning channels, SNMP responses, and backup files retrieved from compromised admin workstations. Reused passwords amplify impact across VPNs, mail, and internal services.

Root Cause

The firmware design stores credentials without applying a one-way hash such as bcrypt, scrypt, or PBKDF2. Configuration objects serialize the password field in its original form. This conflicts with NIST SP 800-63B guidance that verifiers store only salted hashes of memorized secrets.

Attack Vector

Exploitation requires read access to device configuration data. Typical paths include retrieval of an exported .cfg backup, abuse of an authenticated configuration export endpoint, interception of unencrypted management traffic, or extraction from a recovered device. Once retrieved, the attacker parses the configuration and reads the plaintext password fields directly. No cryptographic recovery work is required.

No verified public proof-of-concept is referenced in the NVD entry. See the Medium Security Advisory on DrayTek for additional context on related DrayTek issues.

Detection Methods for CVE-2024-41336

Indicators of Compromise

Unexpected downloads or transfers of DrayTek configuration backup files (.cfg) from management interfaces.
New or modified administrator accounts on Vigor devices that were not created by authorized staff.
Successful logins to VPN, admin, or SSL portals from atypical source IPs using legitimate credentials.
Outbound TR-069 or HTTPS sessions from the router to non-vendor infrastructure.

Detection Strategies

Inspect retained configuration files for cleartext password fields and flag any exfiltration of those files in network telemetry.
Correlate router admin authentication logs with geolocation and source ASN to identify credential reuse from foreign addresses.
Audit firmware versions across the fleet against the fixed versions listed in the DrayTek advisory.

Monitoring Recommendations

Forward router syslog, admin authentication events, and configuration change events to a centralized log platform for retention and alerting.
Alert on access to configuration export URLs and on use of the backup or restore functions outside change windows.
Monitor VPN authentication for impossible-travel and concurrent-session anomalies on accounts stored on affected devices.

How to Mitigate CVE-2024-41336

Immediate Actions Required

Upgrade each affected Vigor model to the fixed firmware version listed by DrayTek for that model.
Rotate every local account, VPN, RADIUS, SNMP, and service password configured on the device after upgrading.
Restrict management interfaces (HTTP, HTTPS, SSH, Telnet, TR-069) to trusted source addresses and disable WAN-side administration.
Recover and review any configuration backups stored on admin workstations, file shares, or cloud storage and treat their credentials as compromised.

Patch Information

DrayTek has released firmware updates that remediate the plaintext password storage. Apply the version specified for each model: Vigor 165/166 v4.2.6, Vigor 2620/LTE200 v3.9.8.8, Vigor 2860/2925 v3.9.7, Vigor 2862/2926 v3.9.9.4, Vigor 2133/2762/2832 v3.9.8, Vigor 2135/2765/2766 v4.4.5.1, Vigor 2865/2866/2927 v4.4.5.3, Vigor 2962/3910 v4.3.2.7, and Vigor 3912 v4.3.5.2. Firmware downloads are available from the DrayTek Official Site.

Workarounds

Disable remote management on the WAN interface and require VPN access for administration.
Enforce ACLs that limit management protocol access to a small set of administrator workstations.
Use unique, high-entropy passwords per device so that exposure of one configuration file does not compromise other systems.
Store configuration backups only in encrypted vaults with audited access.

bash

# Configuration example: restrict management access from the Vigor CLI
sys mngt ftpserver off
sys mngt telnetserver off
sys mngt httpserver off
sys mngt httpsserver on
sys mngt acl_enable 1
sys mngt acl_add 1 <admin_subnet> <mask> https
sys mngt wanlogin 0