CVE-2024-41340

HighCVSS 8.4/10Last modified Jul 5, 2026

Description

An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2025
Last modified
Jul 5, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-413447.5A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate priCVE-2024-413455.4openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.phpCVE-2024-413465.4openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.phpCVE-2024-413476.1openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.phpCVE-2024-413486.1openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.phpCVE-2024-413496.1unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.CVE-2024-41355.4The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This isCVE-2024-413506.1bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.phpCVE-2024-413516.1bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.phpCVE-2024-413537.1phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.phpCVE-2024-413547.1phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.phpCVE-2024-413556.5phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
CVE-2024-41340: High severity, CVSS 8.4 | Vulnix