Medium · 4.7 CVE-2024-41584 EUVD-2024-39081GHSA-h66h-gwq7-wjq2

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sForm…

Published Oct 3, 2024 · Updated Oct 3, 2024 · Assigned by mitre

Description

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter.

Advisories 2

WID-SEC-2024-3086 DrayTek Vigor Router: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2024
NCSC-2024-0388 Kwetsbaarheden verholpen in Draytek Vigor routers NCSC-NL (Netherlands) · Oct 4, 2024

References

https://www.forescout.com/resources/draytek14-vulnerabilities
https://www.forescout.com/resources/draybreak-draytek-research/

EUVD	v3.1	4.7
CISA-ADP	v3.1	4.7