CVE-2024-41585

MEDIUM

DrayTek Vigor3910 Firmware < 4.3.2.6 - OS Command Injection via recvCmd Binary

Title source: llm
STIX 2.1

Description

DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escape from the emulated instance and inject arbitrary commands into the host machine.

References (2)

Core 2

Scores

CVSS v3 6.8
EPSS 0.0079
EPSS Percentile 51.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
draytek/vigor3910_firmware < 4.3.2.6
Published Oct 03, 2024
Tracked Since Feb 18, 2026