5.4

CVE-2024-41587

Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Draytek ≫ Vigor3910 Firmware Version < 4.3.2.8
   Draytek ≫ Vigor3910 Version-
Draytek ≫ Vigor3910 Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor3910 Version-
Draytek ≫ Vigor3912 Firmware Version < 4.3.6.1
   Draytek ≫ Vigor3912 Version-
Draytek ≫ Vigor2962 Firmware Version < 4.3.2.8
   Draytek ≫ Vigor2962 Version-
Draytek ≫ Vigor2962 Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor2962 Version-
Draytek ≫ Vigor165 Firmware Version < 4.2.7
   Draytek ≫ Vigor165 Version-
Draytek ≫ Vigor1000b Firmware Version < 4.3.2.8
   Draytek ≫ Vigor1000b Version-
Draytek ≫ Vigor1000b Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor1000b Version-
Draytek ≫ Vigor166 Firmware Version < 4.2.7
   Draytek ≫ Vigor166 Version-
Draytek ≫ Vigor2135 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2135 Version-
Draytek ≫ Vigor2763 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2763 Version-
Draytek ≫ Vigor2765 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2765 Version-
Draytek ≫ Vigor2865 Firmware Version < 4.4.5.2
   Draytek ≫ Vigor2865 Version-
Draytek ≫ Vigor2766 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2766 Version-
Draytek ≫ Vigor2866 Firmware Version < 4.4.5.2
   Draytek ≫ Vigor2866 Version-
Draytek ≫ Vigor2915 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2915 Version-
Draytek ≫ Vigor2620 Firmware
   Draytek ≫ Vigor2620 Version-
Draytek ≫ Vigor2133 Firmware
   Draytek ≫ Vigor2133 Version-
Draytek ≫ Vigor2762 Firmware
   Draytek ≫ Vigor2762 Version-
Draytek ≫ Vigor2832 Firmware
   Draytek ≫ Vigor2832 Version-
Draytek ≫ Vigor2860 Firmware
   Draytek ≫ Vigor2860 Version-
Draytek ≫ Vigor2862 Firmware
   Draytek ≫ Vigor2862 Version-
Draytek ≫ Vigor2925 Firmware
   Draytek ≫ Vigor2925 Version-
Draytek ≫ Vigor2926 Firmware
   Draytek ≫ Vigor2926 Version-
Draytek ≫ Vigor2952 Firmware
   Draytek ≫ Vigor2952 Version-
Draytek ≫ Vigor3220 Firmware
   Draytek ≫ Vigor3220 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.387
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.forescout.com/resources/draybreak-draytek-research/
Third Party Advisory
Mitigation
Technical Description