CVE-2024-41339: Draytek Vigor165 Firmware RCE Vulnerability

CVE-2024-41339 Overview

CVE-2024-41339 is an unrestricted file upload vulnerability [CWE-434] in the CGI endpoint used to upload configurations across a wide range of DrayTek Vigor routers. Authenticated attackers can upload a crafted kernel module through the configuration upload interface, achieving arbitrary code execution on the affected device. Because loaded kernel modules run with full kernel privileges, successful exploitation gives an attacker complete control of the router, including traffic interception, persistence, and lateral movement into internal networks. The flaw affects multiple firmware branches across the Vigor 165/166, 2620/LTE200, 2860/2925, 2862/2926, 2133/2762/2832, 2135/2765/2766, 2865/2866/2927, 2962/3910, and 3912 product lines.

Critical Impact
An attacker with valid low-privileged credentials can load a malicious kernel module through the configuration CGI, resulting in full compromise of the Vigor router.

Affected Products

DrayTek Vigor 165/166 prior to v4.2.6, Vigor 2620/LTE200 prior to v3.9.8.8, and Vigor 2860/2925 prior to v3.9.7
DrayTek Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, and Vigor 2865/2866/2927 prior to v4.4.5.3
DrayTek Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6

Discovery Timeline

2025-02-27 - CVE-2024-41339 published to NVD
2026-07-05 - Last updated in NVD database

Technical Details for CVE-2024-41339

Vulnerability Analysis

The vulnerability resides in the CGI endpoint that DrayTek Vigor devices expose for uploading configuration bundles through the web management interface. The endpoint accepts uploaded files without validating that the content is a legitimate configuration payload. An attacker can substitute a Linux kernel object (.ko) module for the expected configuration file, and the device processes and loads it into the running kernel. Once loaded, the module executes in kernel context with no sandboxing or integrity verification.

The attack requires network reachability to the management interface and low-privileged credentials, but no user interaction. The impact spans confidentiality, integrity, and availability because a kernel module can read arbitrary memory, hook system calls, tamper with routing and firewall logic, or brick the device.

Root Cause

The root cause is missing file type and integrity validation on the configuration upload CGI handler. The device trusts the uploaded artifact and dispatches it to a code path capable of loading kernel modules, rather than restricting processing to signed, well-formed configuration data. There is no cryptographic signature check, no MIME or magic byte validation, and no privilege boundary between configuration import and kernel module loading.

Attack Vector

Exploitation follows this sequence: the attacker authenticates to the Vigor web interface with any account that can access configuration import, submits an HTTP POST request to the configuration upload CGI carrying a malicious kernel module in place of a configuration file, and the router loads the module. The attacker then interacts with the module through any covert channel it implements, typically a hidden network listener or a syscall hook. Refer to the Faraday Security Advisory on DrayTek Routers for technical details.

Detection Methods for CVE-2024-41339

Indicators of Compromise

Unexpected HTTP POST requests to configuration upload CGI paths on the Vigor management interface, particularly from unusual source IPs or outside change windows.
Router reboots, unexplained configuration changes, or new listening ports on the WAN or LAN interfaces following administrative sessions.
Outbound connections from the router to unknown infrastructure, including DNS or HTTPS traffic that does not match the device's normal update endpoints.

Detection Strategies

Enable and centrally forward Vigor syslog to a SIEM, then alert on configuration import events correlated with authentication from non-administrator source ranges.
Baseline the router's normal outbound traffic and alert on deviations, since a compromised router will typically initiate command-and-control or tunneling traffic.
Monitor management-plane authentication for brute force and credential stuffing against the Vigor web UI, which is a common precursor to exploitation of authenticated CGI flaws.

Monitoring Recommendations

Restrict management interface exposure to a dedicated administration VLAN and log every access attempt for review.
Ingest router logs and network flow telemetry into a centralized analytics platform to correlate router-side events with downstream host activity.
Track firmware versions across the fleet and alert when a device reports a build below the fixed versions listed by DrayTek.

How to Mitigate CVE-2024-41339

Immediate Actions Required

Upgrade each affected Vigor model to the fixed firmware version identified by DrayTek for that product line, for example v4.4.5.3 for Vigor 2865/2866/2927 and v4.3.2.7 for Vigor 2962/3910.
Remove the router's web management interface from the public internet and restrict it to trusted management networks only.
Rotate all administrative and low-privileged credentials on the device, since the vulnerability requires only low privileges to exploit.

Patch Information

DrayTek has published fixed firmware for every affected model. Fixed versions are Vigor 165/166 v4.2.6, Vigor 2620/LTE200 v3.9.8.8, Vigor 2860/2925 v3.9.7, Vigor 2862/2926 v3.9.9.4, Vigor 2133/2762/2832 v3.9.8, Vigor 2135/2765/2766 v4.4.5.1, Vigor 2865/2866/2927 v4.4.5.3, Vigor 2962/3910 v4.3.2.7, and Vigor 3912 v4.3.5.2. The Vigor 2925 branch that reached v3.9.6 is end-of-support for this fix; migrate to a supported model.

Workarounds

Disable remote (WAN-side) access to the web management interface until patching is complete.
Enforce ACLs on the management VLAN so that only known administrator workstations can reach the CGI endpoints.
Enable two-factor authentication where the firmware supports it, and remove any unused low-privilege accounts that could satisfy the authenticated precondition.

bash

# Example: restrict Vigor management access to a single admin subnet
# (apply via the router's management ACL / firewall configuration)
set management http listen lan1
set management https listen lan1
set management acl allow 10.10.10.0/24
set management acl deny 0.0.0.0/0
set management remote-access disable