critical9.8
CVE-2023-33778
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor fi…
Impact
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Draytek | Myvigor | before 2.3.2 |
| Draytek | Vigorswitch Pq2200xb Firmware | before 2.6.7 |
| Draytek | Vigorswitch Pq2121x Firmware | before 2.6.7 |
| Draytek | Vigorswitch P2540xs Firmware | before 2.6.7 |
| Draytek | Vigorswitch P2280x Firmware | before 2.6.7 |
| Draytek | Vigorswitch P2100 Firmware | before 2.6.7 |
| Draytek | Vigorswitch Q2200x Firmware | before 2.6.7 |
| Draytek | Vigorswitch Q2121x Firmware | before 2.6.7 |
| Draytek | Vigorswitch G2540xs Firmware | before 2.6.7 |
| Draytek | Vigorswitch G2280x Firmware | before 2.6.7 |
| Draytek | Vigorswitch G2121 Firmware | before 2.6.7 |
| Draytek | Vigorswitch G2100 Firmware | before 2.6.7 |