CVE-2024-41584 - DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter

Back Back to CVE browser

MEDIUM

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter

Published Oct 3, 2024

4.7

MEDIUM

CVSS 3.1

EPSS 0.30%

Description

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter.

Affected products

Vendor Draytek Product Vigor3910 Firmware Default
unknown
Affected
- ≥ 0, ≤ 4.3.2.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Draytek	Vigor3910 Firmware	unknown	Affected ≥ 0, ≤ 4.3.2.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39081
Advisory
https://www.forescout.com/resources/draybreak-draytek-research/
Third Party Advisory
https://www.forescout.com/resources/draytek14-vulnerabilities
Broken Link

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-39081		Advisory
https://www.forescout.com/resources/draybreak-draytek-research/		Third Party Advisory
https://www.forescout.com/resources/draytek14-vulnerabilities		Broken Link

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 3, 2024

Updated Oct 3, 2024

Reserved Jul 18, 2024

Link CVE-2024-41584

CISA Vulnrichment

Updated Oct 3, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-41584

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Oct 3, 2024

Updated Oct 3, 2024

Link EUVD-2024-39081

GitHub

No data