CVE-2024-41584

Summary

CVE-2024-41584 is a newly disclosed vulnerability affecting DrayTek Vigor3910 devices with firmware versions up to 4.3.2.6. This issue allows authenticated users to execute reflected Cross-Site Scripting (XSS) attacks against these devices through the sFormAuthStr parameter. The lack of proper validation of this input enables the attacker to inject malicious code into web pages viewed by other users, potentially leading to unauthorized access, data theft, or other malicious actions. Users are advised to update their firmware to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.