critical10.0
CVE-2022-32548
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1.
Impact
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Draytek | Vigor3910 Firmware | before 4.3.1.1 |
| Draytek | Vigor1000b Firmware | before 4.3.1.1 |
| Draytek | Vigor2962 Firmware | before 4.3.1.1 |
| Draytek | Vigor2962p Firmware | before 4.3.1.1 |
| Draytek | Vigor2927 Firmware | before 4.4.0 |
| Draytek | Vigor2927ax Firmware | before 4.4.0 |
| Draytek | Vigor2927ac Firmware | before 4.4.0 |
| Draytek | Vigor2927vac Firmware | before 4.4.0 |
| Draytek | Vigor2927l Firmware | before 4.4.0 |
| Draytek | Vigor2927lac Firmware | before 4.4.0 |
| Draytek | Vigor2915 Firmware | before 4.3.3.2 |
| Draytek | Vigor2915ac Firmware | before 4.3.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html
- https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html