7.5

CVE-2024-41594

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Draytek ≫ Vigor2620 Firmware
   Draytek ≫ Vigor2620 Version -
Draytek ≫ Vigor2915 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2915 Version -
Draytek ≫ Vigor2866 Firmware Version < 4.4.5.2
   Draytek ≫ Vigor2866 Version -
Draytek ≫ Vigor2766 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2766 Version -
Draytek ≫ Vigor2865 Firmware Version < 4.4.5.2
   Draytek ≫ Vigor2865 Version -
Draytek ≫ Vigor2765 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2765 Version -
Draytek ≫ Vigor2763 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2763 Version -
Draytek ≫ Vigor2135 Firmware Version < 4.4.5.3
   Draytek ≫ Vigor2135 Version -
Draytek ≫ Vigor166 Firmware Version < 4.2.7
   Draytek ≫ Vigor166 Version -
Draytek ≫ Vigor1000b Firmware Version < 4.3.2.8
   Draytek ≫ Vigor1000b Version -
Draytek ≫ Vigor1000b Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor1000b Version -
Draytek ≫ Vigor165 Firmware Version < 4.2.7
   Draytek ≫ Vigor165 Version -
Draytek ≫ Vigor3910 Firmware Version < 4.3.2.8
   Draytek ≫ Vigor3910 Version -
Draytek ≫ Vigor3910 Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor3910 Version -
Draytek ≫ Vigor2962 Firmware Version < 4.3.2.8
   Draytek ≫ Vigor2962 Version -
Draytek ≫ Vigor2962 Firmware Version >= 4.4.0.0 < 4.4.3.1
   Draytek ≫ Vigor2962 Version -
Draytek ≫ Vigor3912 Firmware Version < 4.3.6.1
   Draytek ≫ Vigor3912 Version -
Draytek ≫ Vigor2133 Firmware
   Draytek ≫ Vigor2133 Version -
Draytek ≫ Vigor2762 Firmware
   Draytek ≫ Vigor2762 Version -
Draytek ≫ Vigor2832 Firmware
   Draytek ≫ Vigor2832 Version -
Draytek ≫ Vigor2860 Firmware
   Draytek ≫ Vigor2860 Version -
Draytek ≫ Vigor2862 Firmware
   Draytek ≫ Vigor2862 Version -
Draytek ≫ Vigor2925 Firmware
   Draytek ≫ Vigor2925 Version -
Draytek ≫ Vigor2926 Firmware
   Draytek ≫ Vigor2926 Version -
Draytek ≫ Vigor2952 Firmware
   Draytek ≫ Vigor2952 Version -
Draytek ≫ Vigor3220 Firmware
   Draytek ≫ Vigor3220 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.187
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

https://www.forescout.com/resources/draybreak-draytek-research/
Third Party Advisory
Mitigation
Technical Description
https://www.forescout.com/resources/draytek14-vulnerabilities
Broken Link