CVE-2024-41593
Status: ModifiedCritical (9.8)—
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.89%
- Percentile among all scored CVEs: 58
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1190Exploit Public-Facing Applicationinitial access95 % - Primary impact
T1059Command and Scripting Interpreterexecution90 %
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indica acceso remoto sin privilegios ni interacción (T1190). CWE-787 (buffer overflow) en dispositivo de red sin autenticación requerida permite ejecución remota de código arbitrario (T1059).
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (24)
Draytek — Vigor1000b FirmwareDraytek — Vigor165 FirmwareDraytek — Vigor166 FirmwareDraytek — Vigor2133 FirmwareDraytek — Vigor2135 FirmwareDraytek — Vigor2620 FirmwareDraytek — Vigor2762 FirmwareDraytek — Vigor2763 FirmwareDraytek — Vigor2765 FirmwareDraytek — Vigor2766 FirmwareDraytek — Vigor2832 FirmwareDraytek — Vigor2860 FirmwareDraytek — Vigor2862 FirmwareDraytek — Vigor2865 FirmwareDraytek — Vigor2866 FirmwareDraytek — Vigor2915 FirmwareDraytek — Vigor2925 FirmwareDraytek — Vigor2926 FirmwareDraytek — Vigor2952 FirmwareDraytek — Vigor2962 FirmwareDraytek — Vigor3220 FirmwareDraytek — Vigor3910 FirmwareDraytek — Vigor3912 FirmwareDraytek — Vigorlte200 Firmware
CWEs
- CWE-787
- CWE-787
References
Raw JSON (NVD)
Show
{
"id": "CVE-2024-41593",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-41593",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-03-13T18:07:09.851527Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2024-10-03T19:15:04.740",
"references": [
{
"url": "https://www.forescout.com/resources/draybreak-draytek-research/",
"tags": [
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.forescout.com/resources/draytek14-vulnerabilities",
"tags": [
"Broken Link"
],
"source": "cve@mitre.org"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow."
},
{
"lang": "es",
"value": "Los dispositivos DrayTek Vigor310 hasta 4.3.2.6 permiten a un atacante remoto ejecutar código arbitrario a través de la función ft_payload_dns(), porque se produce una operación de extensión de signo de byte para el argumento de longitud de una llamada _memcpy, lo que lleva a un desbordamiento de búfer basado en el montón."
}
],
"lastModified": "2026-06-17T07:47:53.480",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3912_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84670562-F228-40A0-A38D-144EA62556D3",
"versionEndExcluding": "4.3.6.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3912:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "282E5318-DAA8-4AA2-8E7D-4B8BD9162153"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0549C870-BE10-441A-B07D-0701915E5A9E",
"versionEndExcluding": "4.3.2.8"
},
{
"criteria": "cpe:2.3:o:draytek:vigor2962_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D1A9825-E419-4740-996A-5928D207FCB6",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2962:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BD0C9A21-7CFE-452F-8505-834AB8579D9B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B937F11C-FC86-4D6E-A46B-BA2CA0FFCEF7",
"versionEndExcluding": "4.3.2.8"
},
{
"criteria": "cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2602941C-255F-4289-9043-D396CC4B3192",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "894E4DDA-D9BE-441D-B447-B1CE52959347"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59521C99-00BA-4503-823E-3FEA44F8DDA0",
"versionEndExcluding": "4.2.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8E644893-0457-43A9-98AB-9DB37A5C415C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDBC681E-CD03-49E5-BC3A-E4A7654975A3",
"versionEndExcluding": "4.3.2.8"
},
{
"criteria": "cpe:2.3:o:draytek:vigor1000b_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABDC93B5-DC0A-4AA4-A340-382F108AE80B",
"versionEndExcluding": "4.4.3.1",
"versionStartIncluding": "4.4.0.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor1000b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9FF86645-253A-4BA3-BA2A-2725575C390D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08B9436B-B2FE-4644-BB06-B0537EC23A71",
"versionEndExcluding": "4.2.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7E33E647-5883-44FA-9915-34B89090D4E4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4AB3320-27F8-4359-AEF8-6B1FDBA67111",
"versionEndExcluding": "4.4.5.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AEDC8A7F-08CF-44D2-A9A5-A1353AF35B45"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2763_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A559F44-80F8-44B7-B70F-BA0B78C85283",
"versionEndExcluding": "4.4.5.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2763:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9EA9DF5D-6651-455A-9305-C42C0FF51F01"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B1826F9-0258-44DD-A471-113CF55CE563",
"versionEndExcluding": "4.4.5.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "60657812-D3A8-4B1B-B7BE-F629991CB053"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2865_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3D46DEC-06AB-489F-A0B5-10C31F80A8C1",
"versionEndExcluding": "4.4.5.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2865:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "871448C6-9183-4828-A287-05F5EC6A44F6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F87D851-15BC-4FC1-8AB7-D5C15B2B74F0",
"versionEndExcluding": "4.4.5.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C0AB3C84-67CA-4531-85FB-1A56F3C93ABF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2866_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89461FD4-897D-44F1-8486-4BCCDE3772DD",
"versionEndExcluding": "4.4.5.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2866:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0D0D2760-739F-4C79-AEDC-8B2CCCA2FF53"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2915_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6E55BCE-BBF0-454B-AE86-45B7298888B3",
"versionEndExcluding": "4.4.5.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2915:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5860CBE4-328E-418D-9E81-1D3AF7DB8F2B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2620_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "289E3E0B-6BA4-44B8-968A-AC374B15B631"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2620:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5D98663B-F2F5-4ADC-9FD5-75846890EEBA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigorlte200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1BD8E59-6C67-4C80-B25F-2C5814A8CF0E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigorlte200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4DBF2015-9315-44C8-A9FE-E86146F1958E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43265128-7E8E-4FE2-8488-AC5734A4AF70"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1878E59C-FB40-435D-940A-8952C56FA88B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52F71B18-89B5-42C7-B4B7-448844D6AFBC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3873B2B9-95C1-4F00-9165-7C4D2A90CDE5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A96F64C0-09DD-4553-AC5F-D722B8321B0D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B0978465-D59F-4C0A-A29F-5D7BE58BA557"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2C4077B-C73F-4431-9103-C09960E203E1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "266C73DE-BFC6-4F3E-B022-559B3971CA44"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2862_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D081E5D-7A68-47A0-9EFE-1FC01DA2FF23"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2862:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8B01EDAE-BB9E-4431-BE8C-6505BA7CA42D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2925_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C470B04-BD57-429B-80FC-328A7D2E35E5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2925:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7536B29C-2030-4331-B8BF-D269D86D199B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2926_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A688631-4B36-43CC-AEF8-D390081F01DC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2926:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AF1B117B-603D-493C-A804-C18ED332A221"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor2952_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E207BB52-29F8-4F2F-AA06-855B38E22958"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor2952:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "167336E2-AAA8-4424-AB07-2D7C9E1542B3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:draytek:vigor3220_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD8437FD-65E2-4203-82B9-8FC32444204A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:draytek:vigor3220:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "64955940-3998-4B76-92D1-D9F3FAB874B4"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}