high7.5
CVE-2024-41594
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI use…
Impact
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Draytek | Vigor2620 Firmware | All versions |
| Draytek | Vigor2915 Firmware | before 4.4.5.3 |
| Draytek | Vigor2866 Firmware | before 4.4.5.2 |
| Draytek | Vigor2766 Firmware | before 4.4.5.3 |
| Draytek | Vigor2865 Firmware | before 4.4.5.2 |
| Draytek | Vigor2765 Firmware | before 4.4.5.3 |
| Draytek | Vigor2763 Firmware | before 4.4.5.3 |
| Draytek | Vigor2135 Firmware | before 4.4.5.3 |
| Draytek | Vigor166 Firmware | before 4.2.7 |
| Draytek | Vigor1000b Firmware | before 4.3.2.8 from 4.4.0.0 before 4.4.3.1 |
| Draytek | Vigor165 Firmware | before 4.2.7 |
| Draytek | Vigor3910 Firmware | before 4.3.2.8 from 4.4.0.0 before 4.4.3.1 |