Vulnerability Description
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Draytek | Vigor3910 Firmware | < 4.3.1.1 |
| Draytek | Vigor3910 | - |
| Draytek | Vigor1000B Firmware | < 4.3.1.1 |
| Draytek | Vigor1000B | - |
| Draytek | Vigor2962 Firmware | < 4.3.1.1 |
| Draytek | Vigor2962 | - |
| Draytek | Vigor2962P Firmware | < 4.3.1.1 |
| Draytek | Vigor2962P | - |
| Draytek | Vigor2927 Firmware | < 4.4.0 |
| Draytek | Vigor2927 | - |
| Draytek | Vigor2927Ax Firmware | < 4.4.0 |
| Draytek | Vigor2927Ax | - |
| Draytek | Vigor2927Ac Firmware | < 4.4.0 |
| Draytek | Vigor2927Ac | - |
| Draytek | Vigor2927Vac Firmware | < 4.4.0 |
| Draytek | Vigor2927Vac | - |
| Draytek | Vigor2927L Firmware | < 4.4.0 |
| Draytek | Vigor2927L | - |
| Draytek | Vigor2927Lac Firmware | < 4.4.0 |
| Draytek | Vigor2927Lac | - |
Related Weaknesses (CWE)
References
- https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytekExploitThird Party Advisory
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-ExploitThird Party Advisory
- https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytekExploitThird Party Advisory
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-ExploitThird Party Advisory
FAQ
What is CVE-2022-32548?
CVE-2022-32548 is a vulnerability with a CVSS score of 10.0 (CRITICAL). An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab f...
How severe is CVE-2022-32548?
CVE-2022-32548 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-32548?
Check the references section above for vendor advisories and patch information. Affected products include: Draytek Vigor3910 Firmware, Draytek Vigor3910, Draytek Vigor1000B Firmware, Draytek Vigor1000B, Draytek Vigor2962 Firmware.