CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-32548
Critical (9.8) in draytek. EPSS 34% chance of exploitation in the next 30 days.
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
Severity
- EPSS
- 34% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-120
- Published
- Modified
- Record from
- the NVD, synced
Affected
- draytek:vigor1000b_firmware
- draytek:vigor165_firmware
- draytek:vigor166_firmware
- draytek:vigor2133_firmware
- draytek:vigor2133ac_firmware
- draytek:vigor2133fvac_firmware
- draytek:vigor2133n_firmware
- draytek:vigor2133vac_firmware
- draytek:vigor2135_firmware
- draytek:vigor2135ac_firmware
- draytek:vigor2135fvac_firmware
- draytek:vigor2135vac_firmware
- draytek:vigor2620l_firmware
- draytek:vigor2620ln_firmware
- draytek:vigor2762_firmware
- draytek:vigor2762ac_firmware
- draytek:vigor2762n_firmware
- draytek:vigor2762vac_firmware
- draytek:vigor2765_firmware
- draytek:vigor2765ac_firmware
- draytek:vigor2765vac_firmware
- draytek:vigor2766_firmware
- draytek:vigor2766ac_firmware
- draytek:vigor2766vac_firmware
- draytek:vigor2832_firmware
- draytek:vigor2862_firmware
- draytek:vigor2862ac_firmware
- draytek:vigor2862b_firmware
- draytek:vigor2862bn_firmware
- draytek:vigor2862l_firmware
- draytek:vigor2862lac_firmware
- draytek:vigor2862ln_firmware
- draytek:vigor2862n_firmware
- draytek:vigor2862vac_firmware
- draytek:vigor2865_firmware
- draytek:vigor2865ac_firmware
- draytek:vigor2865ax_firmware
- draytek:vigor2865l_firmware
- draytek:vigor2865lac_firmware
- draytek:vigor2865vac_firmware
- draytek:vigor2866_firmware
- draytek:vigor2866ac_firmware
- draytek:vigor2866ax_firmware
- draytek:vigor2866l_firmware
- draytek:vigor2866lac_firmware
- draytek:vigor2866vac_firmware
- draytek:vigor2915_firmware
- draytek:vigor2915ac_firmware
- draytek:vigor2926_firmware
- draytek:vigor2926ac_firmware
References
- https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html
- https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html