CVE-2024-41338
📋 TL;DR
A NULL pointer dereference vulnerability in multiple Draytek router models allows attackers to cause Denial of Service (DoS) via specially crafted DHCP requests. This affects organizations and individuals using vulnerable Draytek Vigor routers across numerous product lines. The vulnerability can crash affected devices, disrupting network connectivity.
💻 Affected Systems
- Draytek Vigor 165
- Draytek Vigor 166
- Draytek Vigor 2620
- Draytek Vigor LTE200
- Draytek Vigor 2860
- Draytek Vigor 2925
- Draytek Vigor 2862
- Draytek Vigor 2926
- Draytek Vigor 2133
- Draytek Vigor 2762
- Draytek Vigor 2832
- Draytek Vigor 2135
- Draytek Vigor 2765
- Draytek Vigor 2766
- Draytek Vigor 2865
- Draytek Vigor 2866
- Draytek Vigor 2927
- Draytek Vigor 2962
- Draytek Vigor 3910
- Draytek Vigor 3912
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, extended network downtime affecting all connected services and users.
Likely Case
Temporary service disruption until device automatically reboots or is manually restarted, causing brief network outages.
If Mitigated
Minimal impact if devices are patched or network segmentation prevents DHCP requests from untrusted sources.
🎯 Exploit Status
Exploitation requires network access to send DHCP requests but no authentication. Attack complexity is low as DHCP is a standard protocol.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by model - see CVE description for specific fixed versions per product line.
Vendor Advisory: http://draytek.com
Restart Required: Yes
Instructions:
1. Identify your Draytek router model. 2. Visit Draytek support website. 3. Download appropriate firmware version for your model. 4. Backup current configuration. 5. Upload and install new firmware via web interface. 6. Reboot device after installation.
🔧 Temporary Workarounds
Disable DHCP server
allDisable the built-in DHCP server and use external DHCP server instead
Network segmentation
allSegment network to restrict DHCP requests to trusted devices only
🧯 If You Can't Patch
- Implement network access controls to restrict DHCP traffic to trusted sources only
- Monitor for abnormal DHCP request patterns and device crashes
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface and compare against patched versions listed in CVE descriptionCheck Version:
Login to router web interface > System Maintenance > Firmware InformationVerify Fix Applied:
Verify firmware version matches or exceeds patched version for your specific model📡 Detection & Monitoring
Log Indicators:
- Device crash/reboot logs
- DHCP service failure messages
- Unusual DHCP request patterns
Network Indicators:
- Malformed DHCP packets
- Sudden loss of connectivity to router
- DHCP service unresponsive
SIEM Query:
source="router_logs" AND ("crash" OR "reboot" OR "DHCP error")