CVE Feed

    Dashboard / CVE / CVE-2024-23721

    CVE-2024-23721

    A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information.

    Published:Mar 20, 2024
    Last Modified:May 23, 2025
    EPS:Mar 20, 2024
    EPSS Score:0.01523
    CVSS Score:7.5

    Affected Products

    Vendor
    Draytek
    Product
    Vigor3910
    Vendor
    Draytek
    Product
    Vigor3910 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-41339 (CVSS 8.8) — An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , …
    CVE-2024-41334 (CVSS 8.8) — Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to …
    CVE-2024-41340 (CVSS 8.4) — An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/29…
    CVE-2024-51139 (CVSS 9.8) — Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and…
    CVE-2024-51138 (CVSS 9.8) — Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2…
    CVE-2024-41338 (CVSS 7.5) — A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.…
    CVE-2024-41584 (CVSS 4.7) — DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by mi…
    CVE-2024-41590 (CVSS 8) — Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds ch…
    CVE-2024-41585 (CVSS 6.8) — DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an…
    CVE-2024-41596 (CVSS 8) — Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI)…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High