CVE-2024-41338
HIGHDescription
A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request.
Is your site exposed to CVE-2024-41338?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| draytek | vigor165_firmware |
| draytek | vigor165 |
| draytek | vigor166_firmware |
| draytek | vigor166 |
| draytek | vigor2620_firmware |
| draytek | vigor2620 |
| draytek | vigorlte200_firmware |
| draytek | vigorlte200 |
| draytek | vigor2860_firmware |
| draytek | vigor2860 |
| draytek | vigor2925_firmware |
| draytek | vigor2925 |
| draytek | vigor2862_firmware |
| draytek | vigor2862 |
| draytek | vigor2926_firmware |
| draytek | vigor2926 |
| draytek | vigor2133_firmware |
| draytek | vigor2133 |
| draytek | vigor2762_firmware |
| draytek | vigor2762 |
| draytek | vigor2832_firmware |
| draytek | vigor2832 |
| draytek | vigor2135_firmware |
| draytek | vigor2135 |
| draytek | vigor2765_firmware |
| draytek | vigor2765 |
| draytek | vigor2766_firmware |
| draytek | vigor2766 |
| draytek | vigor2865_firmware |
| draytek | vigor2865 |
| draytek | vigor2866_firmware |
| draytek | vigor2866 |
| draytek | vigor2927_firmware |
| draytek | vigor2927 |
| draytek | vigor2962_firmware |
| draytek | vigor2962 |
| draytek | vigor3910_firmware |
| draytek | vigor3910 |
| draytek | vigor3912_firmware |
| draytek | vigor3912 |
References
Frequently Asked Questions
What is CVE-2024-41338? +
How severe is CVE-2024-41338? +
What products are affected by CVE-2024-41338? +
How do I check if I'm vulnerable to CVE-2024-41338? +
Related Vulnerabilities
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence …
PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the …
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder …
A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local …
GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. NOTE: this …
A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered …