CVE-2024-41594
03.10.2024, 19:15
An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.Enginsight
| Vendor | Product | Version |
|---|---|---|
| draytek | vigor2620_firmware | * |
| draytek | vigor2915_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2866_firmware | 𝑥 < 4.4.5.2 |
| draytek | vigor2766_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2865_firmware | 𝑥 < 4.4.5.2 |
| draytek | vigor2765_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2763_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor2135_firmware | 𝑥 < 4.4.5.3 |
| draytek | vigor166_firmware | 𝑥 < 4.2.7 |
| draytek | vigor1000b_firmware | 𝑥 < 4.3.2.8 |
| draytek | vigor1000b_firmware | 4.4.0.0 ≤ 𝑥 < 4.4.3.1 |
| draytek | vigor165_firmware | 𝑥 < 4.2.7 |
| draytek | vigor3910_firmware | 𝑥 < 4.3.2.8 |
| draytek | vigor3910_firmware | 4.4.0.0 ≤ 𝑥 < 4.4.3.1 |
| draytek | vigor2962_firmware | 𝑥 < 4.3.2.8 |
| draytek | vigor2962_firmware | 4.4.0.0 ≤ 𝑥 < 4.4.3.1 |
| draytek | vigor3912_firmware | 𝑥 < 4.3.6.1 |
| draytek | vigorlte200_firmware | * |
| draytek | vigor2133_firmware | * |
| draytek | vigor2762_firmware | * |
| draytek | vigor2832_firmware | * |
| draytek | vigor2860_firmware | * |
| draytek | vigor2862_firmware | * |
| draytek | vigor2925_firmware | * |
| draytek | vigor2926_firmware | * |
| draytek | vigor2952_firmware | * |
| draytek | vigor3220_firmware | * |
𝑥
= Vulnerable software versions
Common Weakness Enumeration