CVE-2024-41338

Executive Summary

CVE-2024-41338 is an unauthenticated denial-of-service (DoS) vulnerability affecting a broad range of Draytek Vigor routers and LTE gateways. A NULL pointer dereference is triggered when the device parses a specially crafted DHCP request, causing the affected firmware to crash or hang. The flaw spans ten device families and numerous firmware branches, impacting edge gateways, VPN concentrators, and LTE failover appliances in small-to-medium business deployments. Because the vulnerable component is reachable over the network without authentication and no verified patch is currently available, affected devices remain open to trivial crash-based disruption by any host able to deliver a DHCP packet to the device.

Technical Analysis

The vulnerability is a NULL pointer dereference (CWE-476) located in the DHCP request-handling logic of Draytek's proprietary firmware. The NVD description confirms that a "crafted DHCP request" is sufficient to trigger the fault; no pre-authentication or privileged access is mentioned, implying the flaw is reachable from the default attack surface of the device.

DHCP is implemented over UDP port 67 (server) and 68 (client). Draytek Vigor devices operate as DHCP servers on LAN interfaces and DHCP clients on WAN/PPPoE uplinks, which broadens the exposure: a malicious packet can arrive from an internal workstation, a compromised IoT host on the LAN, or — in the case of WAN-facing DHCP client logic — from the upstream network. The parsing routine likely accesses a protocol field or option pointer (e.g., an option code, length, or encapsulated sub-option) that can be forced to a NULL or zero value. When the firmware dereferences this pointer without a validity check, the CPU raises a data-abort exception. Depending on the firmware's exception handling, the result is either a process restart, a watchdog-triggered reboot, or a full device hang.

The NVD description lacks code-level specifics: no function names, source files, or option identifiers are disclosed. The affected version matrix is notable for its breadth — firmware branches as old as v3.9.x and as new as v4.4.x are vulnerable, strongly suggesting the flawed DHCP parsing code has been copied across device families for years. This cross-branch propagation also implies that a single crafted-packet technique may be effective across all ten families, although packet-level differences between firmware branches have not been confirmed. The lack of a CVE-assigned CVSS score and CWE entry limits quantitative analysis, but the vulnerability class carries well-understood implications: a single UDP packet can reset or freeze an edge appliance with no authentication and no user interaction.

Exploitation Scenarios

No public PoC or exploit code was available during this analysis, so the attack chain is inferred from the vulnerability class (NULL pointer dereference in DHCP parsing) and the NVD description. The likely chain is as follows:

1. Reconnaissance / target identification. An attacker enumerates internet-facing Draytek devices using Shodan/Fofafa queries (e.g., http.title:"Vigor") or identifies internal targets by observing DHCP server advertisements (DHCP offer/Ack from the router's MAC, vendor class "draytek"). Vigor devices frequently expose telnet/SSH, web management, and the LAN DHCP service; the DHCP service itself is normally broadcast-accessible on 255.255.255.255:67.

2. **Trigger. The attacker builds a malformed DHCP request (DHCPDISCOVER or DHCPREQUEST) using a raw socket or a tool such as scapy. The packet deviates from RFC 2132 option encoding in a way that destabilizes the parser — for example, an option code with a length field that underflows to an invalid pointer, a truncated options block, or a malformed encapsulated sub-option (option 43/124/125). Because the packet must reach the device's DHCP server, it can be sent as a broadcast to UDP/67 or unicast to the device's IP.

3. Payload / execution. The request is delivered in a single UDP datagram. No shellcode or memory-corruption payload is required; the NULL dereference is a logic fault, not a buffer overflow. The entire exploit is the carefully malformed DHCP option stream — a low-bandwidth, low-complexity attack that evades signature-based defenses that look for large payloads.

4. Post-exploitation impact. The device resets or hangs. On a branch-office gateway this produces immediate loss of LAN-to-WAN routing, DHCP service, VPN tunnels (L2TP/IPsec/SSL), and any LTE failover path. Repeated triggering keeps the device in a crash loop. Since the flaw is in pre-auth code, the attacker never needs credentials. Lateral movement beyond DoS is unlikely without a chained vulnerability, but the outage itself can be used to mask other malicious activity, force failover to a less-monitored path, or disrupt operations as a pressure tactic.

The absence of CISA KEV listing and the low EPSS percentile (0.00437) suggest this is not currently exploited in the wild at scale; however, the unpatched status and trivial trigger make it a prime candidate for weaponization once reverse-engineered from the fixed firmware builds.

Impact Assessment

Business impact is high for availability and low for confidentiality/integrity. The vulnerability lets any unauthenticated network actor crash or reboot a Draytek Vigor gateway with a single UDP packet. Affected products serve as the primary WAN edge, VPN terminator, and DHCP authority for SMB and branch-office networks; an outage collapses Internet connectivity, internal addressing, and remote-access VPNs simultaneously.

Blast radius:

• LAN-facing attack: any compromised workstation, guest-network client, or IoT device inside the LAN can kill the gateway — no firewall rule changes required.
• WAN-facing attack: if the DHCP client on the WAN/uplink interface is the vulnerable code path, an upstream ISP-side attacker or a malicious DHCP server on the WAN segment could trigger the fault, which would also grant crash capability to an outside party.
• Device families affected: 10 families spanning SOHO (165/166, 2133/2135), mid-range (2620/LTE200, 2762/2765/2766, 2832/2862), and high-end (2860/2865/2866, 2925/2926/2927, 2962, 3910/3912) routers — most of Draytek's current lineup.

CVSS is N/A, which hinders standard risk-scoring workflows; relying on the NVD description alone, the vulnerability corresponds to a high-Availability-impact finding with no privileges required and no user interaction (approximating CVSS base ~7.5 in most network contexts). Since patch confidence is 0/4, every vulnerable device is effectively unpatched today, making the practical risk equal to the exposure window.

Detection Guidance

Detection is challenging because the triggering packet is malformed by design and may appear only once. The rules below are heuristic detections for the vulnerability class and should be tuned to local network baselines.

Sigma Rule

title: Draytek Vigor Crafted DHCP Request DoS Attempt (CVE-2024-41338)
id: 5f6a2c9d-4b7e-4d2a-9f3c-8a1b2c3d4e5f
status: experimental
description: Detects malformed DHCP request packets sent to UDP/67 that deviate from RFC 2132 option encoding, potentially triggering a NULL pointer dereference in Draytek Vigor firmware.
author: Valtersit Threat Intelligence
date: 2025/03/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41338
tags:
    - attack.t1499
logsource:
    category: network-connection
    product: firewall
    service: dhcp
detection:
    selection_dest_port:
        destination.port: 67
        destination.ip: "255.255.255.255"   # broadcast DHCP
    selection_broadcast_source:
        source.port: 68
    filter_known_clients:
        source.ip:
            - "10.0.0.0/8"
            - "192.168.0.0/16"
            - "172.16.0.0/12"
    condition: selection_dest_port and selection_broadcast_source and not filter_known_clients
falsepositives:
    - Legitimate DHCP clients with non-compliant stacks
    - Network scanners sending DHCP probes
level: medium

YARA Rule

rule Draytek_Vigor_malformed_DHCP_CVE_2024_41338
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Heuristic match on DHCP payloads with anomalous option encodings consistent with CVE-2024-41338 NULL pointer dereference trigger"
        cve = "2024-41338"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-41338"
        date = "2025-03-01"
    strings:
        $dhcp_cookie = { 63 82 53 63 }                 // DHCP magic cookie
        $opt_excessive_len = { 00 (FF) }               // option 0 (pad) anomalies
        $opt_short_trunc   = { 3C 02 }                 // option 60 with bogus length
        $opt_overflow_len  = { 7D FF }                 // option 125 with oversized length
    condition:
        $dhcp_cookie at 0 and
        (
            #opt_excessive_len > 20 or
            #opt_short_trunc > 10 or
            #opt_overflow_len > kM
        )
}

Note: This rule is a traffic-layer heuristic; without the vendor's parsing code, exact byte-level fingerprints cannot be confirmed. Tune lengths to local DHCP baselines.

Suricata IDS Rule

alert udp any any -> any 67 (msg:"ET DOS Draytek Vigor Crafted DHCP Request NULL Pointer Dereference Attempt CVE-2024-41338"; dsize:>240; content:"|63 82 53 63|"; offset:236; depth:4; content:"|ff|"; within:200; classtype:attempted-dos; sid:5041338; rev:1; metadata:created_at 2025_03_01, updated_at 2025_03_01, cve CVE-2024-41338;)

The rule keys on DHCP packets (UDP/67) carrying the DHCP magic cookie followed by an abnormally large number of pad/option bytes — a hallmark of fuzz-generated DHCP option fields. Alerting purely on option-table anomalies will produce false positives from exotic but legitimate DHCP clients, so pair this rule with rate-limit logic in production.

Elastic Detection

sequence by host.ip with maxspan=5m
  [ network where network.protocol == "dhcp" and destination.port == 67 and
      event.action == "connection" and
      /* malformed option-length indicators, e.g., DHCP option 60 length exceeds remaining packet */
      (network.bytes > 240 and network.bytes < 1500) ]
  [ process where event.action == "end" and
      process.name == "*vigor*" or winlog.event_data.Image == "C:\\Draytek*" ]

This EQL detects a crafted DHCP burst to UDP/67 followed by the termination of a Draytek-related process. On appliances where process-level telemetry is unavailable, replace the second event with a host availability check (e.g., missing heartbeat within 5 minutes).

Splunk SPL Query

index=network sourcetype=dhcp OR index=firewall
| where dest_port=67 AND (dest_ip="255.255.255.255" OR dest_ip=VigorGatewayIP)
| eval option_anomaly = if(match(raw,"Option\s+5[3-9]\s+len\s+[0-9]{3,}") OR match(raw,"Malformed"),1,0)
| stats count(eval(option_anomaly=1)) as bad_req, dc(src_ip) as src_count by dest_ip, _time
| bucket _time span=5m
| where bad_req > 3
| table _time, dest_ip, bad_req, src_count
| join type=left dest_ip [ search index=network sourcetype=syslog "Vigor*reboot*" earliest=-5m
    | stats count as reboot_events by dest_ip ]

The query correlates a short burst of malformed DHCP requests against a Draytek gateway with subsequent reboot or watchdog syslog events, flagging likely crash attempts.

Wazuh OSSEC Rule

<rule id="946528" level="12">
  <decoded>draytek</decoded>
  <match>DHCP|Dhcp|dhcp</match>
  <regex>error|crash|exception|reboot|watchdog</regex>
  <description>CVE-2024-41338: possible NULL pointer dereference triggered via crafted DHCP request on Draytek Vigor device</description>
  <group>dos,attack,draytek,</group>
  <mitre>
    <id>T1499</id>
  </mitre>
</rule>

Pair this with a decoder that parses Draytek syslog output (e.g., entries such as "DHCP server exception, restarting"). The rule fires only when a DHCP-related error message is accompanied by crash/reboot keywords, minimizing false positives.

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence from any tracked source was found. Although the NVD description lists fixed firmware versions (Vigor 165/166 v4.2.6; Vigor 2620/LTE200 v3.9.8.8; Vigor 2860/2925 v3.9.7; Vigor 2862/2926 v3.9.9.4; Vigor 2133/2762/2832 v3.9.8; Vigor 2135/2765/2766 v4.4.5.1; Vigor 2865/2866/2927 v4.4.5.3; Vigor 2962/3910 v4.3.2.7; Vigor 3912 v4.3.5.2), no vendor advisory or downloadable firmware confirming these as security fixes has been verified by our tracking sources. Until a vendor-verified firmware is available, treat all listed devices as vulnerable.

Immediate mitigations (do these today):

1. Where possible, disable the DHCP server on LAN interfaces and use a dedicated internal DHCP server or the upstream gateway — this removes the primary LAN attack surface.
2. If DHCP must remain enabled, restrict DHCP service to known VLANs/ports and apply an ACL at the switch or router level so that only whitelisted MAC/IP ranges can reach UDP/67 on the Vigor interface.
3. If the vulnerable code path is WAN-facing DHCP client logic, configure static WAN IPs or use PPPoE with vendor-ID restrictions to eliminate upstream DHCP interactions.
4. Monitor for repeated malformed DHCP traffic and the reboot/watchdog syslog patterns described in the Detection Guidance section.

Patch/upgrade steps:

1. Confirm current firmware and device model via the web UI (Diagnostics → System Information).
2. Subscribe to Draytek's security advisory feed (draytek.com/support) and the NVD notification for CVE-2024-41338.
3. When Draytek releases firmware equal to or higher than the versions listed in the NVD description, stage and validate it in a lab, then deploy during a maintenance window.
4. After patching, re-test DHCP service from both LAN and WAN paths.

Long-term hardening:

• Disable remote management (web/telnet/SSH) from WAN; bind management to a dedicated management VLAN.
• Segment guest networks from the management plane and DHCP infrastructure.
• Deploy DHCP snooping on managed switches to block rogue DHCP servers and abnormal DHCP packet shapes.
• Track future CISA KEV updates; if CVE-2024-41338 is added to KEV, elevate emergency-patch priority.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2024-41338
2. Draytek Official Site (firmware & advisories) — https://www.draytek.com/support/
3. MITRE ATT&CK Technique T1499 (Endpoint Denial of Service) — https://attack.mitre.org/techniques/T1499/
4. CWE-476 NULL Pointer Dereference — https://cwe.mitre.org/data/definitions/476.html
5. CISA Known Exploited Vulnerabilities Catalog (no current listing for CVE-2024-41338) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: No threat-actor campaigns or exploit-in-the-wild activity have been publicly documented for CVE-2024-41338 as of this report. EPSS score 0.00437 (36.4th percentile) indicates low immediate exploitation likelihood; however, the unpatched status across ten device families makes this an attractive target for botnet operators seeking to knock SMB gateways offline.