CVE-2024-41338 Null dereference in n/a

High 7.5 Published 27 Feb 2025 Updated 5 Jul 2026

Attackers can cause a Denial of Service on Draytek routers via a crafted DHCP request due to a NULL pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-41338?

CVE-2024-41338 is a high-severity vulnerability in Draytek Vigor3910 Firmware, published on 27 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request.

Weakness: CWE-476

Which versions are affected by CVE-2024-41338?

It affects 20 products.

Products include Draytek Vigor165 Firmware, Draytek Vigor166 Firmware, Draytek Vigor2133 Firmware, Draytek Vigor2135 Firmware, Draytek Vigor2620 Firmware, Draytek Vigor2762 Firmware and 14 more.

How do I fix CVE-2024-41338?

No fix has been published for CVE-2024-41338 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-41338 being exploited?

There is no known exploitation of CVE-2024-41338 in the wild and no public exploit code.

All Draytek Vigor3910 Firmware vulnerabilities

Sources

Also known as GHSA-22qr-hr3v-pmr2.