CVE-2024-41583 in Vigor3910
Summary
by MITRE • 10/03/2024
DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitization of the router name.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/08/2025
The DrayTek Vigor3910 router series represents a widely deployed network infrastructure device that serves as a gateway for numerous enterprise and residential networks. This vulnerability affects firmware versions up to and including 4.3.2.6, making it a significant concern for organizations relying on these devices for their network security. The device operates as a router with web-based management interfaces, allowing administrators to configure various network parameters and monitor system status. The vulnerability stems from insufficient input validation and sanitization mechanisms within the web interface, specifically targeting the router name field that users can modify through the administrative console.
The technical flaw manifests as a stored cross site scripting vulnerability that occurs when authenticated users input malicious script code into the router name field. When this compromised name is subsequently displayed in the web interface or rendered in HTML contexts, the malicious script executes within the browser context of other authenticated users who view the affected page. This represents a classic stored XSS vulnerability where the payload is permanently stored on the server and executed whenever the affected content is retrieved. The vulnerability is particularly concerning because it requires only authenticated access to the device, meaning that any user with administrative credentials can exploit this weakness.
The operational impact of this vulnerability extends beyond simple script execution, as it provides potential attackers with the ability to steal session cookies, perform unauthorized administrative actions, or redirect users to malicious websites. An attacker who gains access to an authenticated session can leverage this vulnerability to maintain persistent access to the network infrastructure, potentially leading to complete network compromise. The stored nature of the XSS means that the malicious payload remains active even after the initial injection, continuously affecting any user who accesses the affected web interface. This vulnerability also aligns with CWE-79, which specifically addresses cross site scripting flaws in web applications, and can be mapped to ATT&CK technique T1566.002 for the exploitation of web applications through malicious scripts.
Organizations should immediately implement mitigations including firmware updates from DrayTek to address the XSS vulnerability in the router name field. Network administrators should also consider implementing additional security controls such as web application firewalls that can detect and block malicious script payloads. The principle of least privilege should be enforced by limiting administrative access to only necessary personnel and implementing multi-factor authentication where possible. Regular security assessments of network infrastructure devices should include checks for similar input validation vulnerabilities, and network segmentation should be implemented to limit the potential impact of any successful exploitation. Additionally, monitoring for unusual administrative activities and implementing proper logging of configuration changes can help detect unauthorized modifications to router settings that might indicate exploitation attempts.