CVE-2024-41593 Memory corruption in n/a

Critical 9.8 Published 3 Oct 2024 Updated 13 Mar 2025

Remote attackers can execute arbitrary code on DrayTek Vigor310 routers due to a heap-based buffer overflow in DNS payload processing.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-41593?

CVE-2024-41593 is a critical memory corruption vulnerability in Draytek Vigor3910 Firmware, published on 3 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension operation occurs for the length argument of a _memcpy call, leading to a heap-based Buffer Overflow.

Weakness: CWE-787

Which versions are affected by CVE-2024-41593?

It affects 24 products.

Products include Draytek Vigor1000b Firmware, Draytek Vigor165 Firmware, Draytek Vigor166 Firmware, Draytek Vigor2133 Firmware, Draytek Vigor2135 Firmware, Draytek Vigor2620 Firmware and 18 more.

How do I fix CVE-2024-41593?

No fix has been published for CVE-2024-41593 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-41593 being exploited?

There is no known exploitation of CVE-2024-41593 in the wild and no public exploit code.

All Draytek Vigor3910 Firmware vulnerabilities

Sources

Also known as GHSA-82ch-xgf6-4685.