CVE-2024-23721

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23721
A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://draytek.com Product
https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 Third Party Advisory
https://draytek.com Product
https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*
History

23 May 2025, 14:42

Type Values Removed Values Added
First Time Draytek
Draytek vigor3910
Draytek vigor3910 Firmware
References () https://draytek.com - () https://draytek.com - Product
References () https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 - () https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 - Third Party Advisory
CPE cpe:2.3:o:draytek:vigor3910_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigor3910:-:*:*:*:*:*:*:*

21 Nov 2024, 08:58

Type Values Removed Values Added
References () https://draytek.com - () https://draytek.com -
References () https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 - () https://gist.github.com/rrrrrrri/8e9cac08eb4d9c01ab258bd5b0f8f7d8 -

28 Aug 2024, 15:35

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema de Directory Traversal en process_post en dispositivos Draytek Vigor3910 4.3.2.5. Al enviar una determinada solicitud POST, llama a la función y exporta información.
CWE CWE-22
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

20 Mar 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-20 20:15

Updated : 2025-05-23 14:42

NVD link : CVE-2024-23721

Mitre link : CVE-2024-23721

CVE.ORG link : CVE-2024-23721

JSON object : View

Products Affected

draytek

  • vigor3910_firmware
  • vigor3910
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')