CVE-2024-41335 affects multiple Draytek Vigor devices, including models 165/166, 2620/LTE200, 2860/2925, 2862/2926, 2133/2762/2832, 2135/2765/2766, 2865/2866/2927, 2962/3910, 3912, and 2925. These devices use insecure versions of the strcmp and memcmp functions, which can be exploited via timing attacks to potentially leak sensitive information. The vulnerability is present in firmware versions prior to specific fixed versions listed per model. The CVSS 3.1 base score is 7.5, reflecting high severity due to the ability to obtain sensitive information remotely without authentication or user interaction. No official remediation level or patch links are provided in the data.

An attacker can exploit timing differences in the insecure strcmp and memcmp implementations to obtain sensitive information from affected Draytek Vigor devices remotely without requiring privileges or user interaction. The confidentiality impact is high, but integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users of affected Draytek Vigor devices should monitor Draytek's official channels for firmware updates addressing this vulnerability. Until patches are available, consider limiting network exposure of affected devices to untrusted networks.