CVE-2024-41336

HighCVSS 7.5/10Last modified Jul 5, 2026

Description

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to store passwords in plaintext.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2025
Last modified: Jul 5, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-413387.5A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to CVE-2024-413398.8An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.CVE-2024-413408.4An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862 CVE-2024-413447.5A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate pri CVE-2024-413455.4openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php CVE-2024-413465.4openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php CVE-2024-413476.1openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php CVE-2024-413486.1openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php CVE-2024-413496.1unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.CVE-2024-41355.4The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is CVE-2024-413506.1bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php CVE-2024-413516.1bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php