Entreprise d'experts en Sécurité Informatique : Audits et conseils en cybersécurité
Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com


CVE-2024-41594

Description

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL.

POC

Reference

- https://www.forescout.com/resources/draytek14-vulnerabilities

Github

- https://github.com/chnzzh/OpenSSL-CVE-lib

- https://github.com/fkie-cad/nvd-json-data-feeds