#VU97966 Stored cross-site scripting in DrayTek Corp. products - CVE-2024-41583
Published: October 2, 2024
Vulnerability identifier: #VU97966
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-41583
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Vigor 1000B
Vigor 2962
Vigor 3910
Vigor 3912
Vigor 165
Vigor 166
Vigor 2135
Vigor 2763
Vigor 2765
Vigor 2766
Vigor 2865
Vigor 2866
Vigor 2915
Vigor 2620
Vigor LTE200
Vigor 2133
Vigor 2762
Vigor 2860
Vigor 2925
Vigor 2862
Vigor 2926
Vigor 2952
Vigor 3220
Vigor 2832
Vigor 1000B
Vigor 2962
Vigor 3910
Vigor 3912
Vigor 165
Vigor 166
Vigor 2135
Vigor 2763
Vigor 2765
Vigor 2766
Vigor 2865
Vigor 2866
Vigor 2915
Vigor 2620
Vigor LTE200
Vigor 2133
Vigor 2762
Vigor 2860
Vigor 2925
Vigor 2862
Vigor 2926
Vigor 2952
Vigor 3220
Vigor 2832
Software vendor:
DrayTek Corp.
DrayTek Corp.
Description
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when handling a custom router name. A remote user can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Remediation
Install updates from vendor's website.