SB2025040126 - Multiple vulnerabilities in Draytek routers

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Improper Certificate Validation (CVE-ID: CVE-2024-41334)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing SSL certificate validation for APP Enforcement signature updates. A remote attacker can install specially crafted APPE modules from unofficial servers and execute arbitrary code on the system.

2) Code Injection (CVE-ID: CVE-2024-41339)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to undocumented kernel module installation through CGI configuration endpoint. A remote attacker can execute arbitrary code on the target system.

3) Observable discrepancy (CVE-ID: CVE-2024-41335)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected products utilize insecure versions of the functions strcmp and memcmp to compare credentials. A remote attacker can gain unauthorized access to sensitive information on the system.

4) Unprotected storage of credentials (CVE-ID: CVE-2024-41336)

The vulnerability allows a local attacker to gain access to sensitive information.

The vulnerability exists due to application stored credentials in plain text. An attacker with physical access can dump credentials.

5) NULL pointer dereference (CVE-ID: CVE-2024-41338)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted DHCP request and perform a denial of service (DoS) attack.

6) Arbitrary file upload (CVE-ID: CVE-2024-41340)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote attacker can upload specially crafted APP Enforcement modules and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• http://draytek.com
• https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
• https://www.draytek.com/about/security-advisory/denial-of-service,-information-disclosure,-and-code-execution-vulnerabilities
• https://www.draytek.com/about/security-advisory/denial-of-service,-information-disclosure,-and-code-...