CVE-2024-41339 File upload in n/a

High 8.8 Published 27 Feb 2025 Updated 8 Jul 2026

Attackers can upload a crafted kernel module via the CGI endpoint to achieve arbitrary code execution on Draytek routers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-41339?

CVE-2024-41339 is a high-severity vulnerability in Draytek Vigor3910 Firmware, published on 27 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution.

Weakness: CWE-434

Which versions are affected by CVE-2024-41339?

It affects 20 products.

Products include Draytek Vigor165 Firmware, Draytek Vigor166 Firmware, Draytek Vigor2133 Firmware, Draytek Vigor2135 Firmware, Draytek Vigor2620 Firmware, Draytek Vigor2762 Firmware and 14 more.

How do I fix CVE-2024-41339?

No fix has been published for CVE-2024-41339 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-41339 being exploited?

There is no known exploitation of CVE-2024-41339 in the wild and no public exploit code.

All Draytek Vigor3910 Firmware vulnerabilities

Sources

Also known as GHSA-cpr3-4f88-q3jq.