CVE-2024-41336 identifies a vulnerability in multiple Draytek Vigor router models where passwords are stored in plaintext in firmware versions prior to certain fixed releases. The affected devices include various models with firmware versions below 4.2.6, 3.9.8.8, 3.9.7, 3.9.9.4, 3.9.8, 4.4.5.1, 4.4.5.3, 4.3.2.7, 4.3.5.2, and up to 3.9.6 for the Vigor 2925. This vulnerability corresponds to CWE-256 (Plaintext Storage of a Password) and has a CVSS v3.1 base score of 7.5, indicating high severity. The attack vector is network-based with no privileges or user interaction required, and the impact is high confidentiality loss due to exposure of passwords. No official patch or remediation level is indicated in the available data, and no known exploits in the wild have been reported.

The vulnerability allows an unauthenticated attacker with network access to retrieve passwords stored in plaintext on affected Draytek devices. This compromises the confidentiality of sensitive credentials, potentially enabling unauthorized access to device management interfaces or network resources. There is no indication of impact to integrity or availability. The high CVSS score reflects the significant confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to device management interfaces to trusted users only and monitor for unauthorized access attempts. Avoid exposing affected devices directly to untrusted networks. Follow vendor communications for firmware updates addressing this issue.