CVE-2022-32548
Critical
Description
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
SeverityCritical
CVSS10.0
Exploit probability—
Product
Draytek Vigor3910 Firmware
PublishedAug 29, 2022
First seenAug 29, 2022
How to fix
Update
- draytek vigor3910_firmware4.3.1.1 or later
- draytek vigor1000b_firmware4.3.1.1 or later
- draytek vigor2962_firmware4.3.1.1 or later
- draytek vigor2962p_firmware4.3.1.1 or later
- draytek vigor2927_firmware4.4.0 or later
- draytek vigor2927ax_firmware4.4.0 or later
- draytek vigor2927ac_firmware4.4.0 or later
- draytek vigor2927vac_firmware4.4.0 or later
- draytek vigor2927l_firmware4.4.0 or later
- draytek vigor2927lac_firmware4.4.0 or later
- draytek vigor2915_firmware4.3.3.2 or later
- draytek vigor2915ac_firmware4.3.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| draytek vigor3910_firmware | v < 4.3.1.1 | 4.3.1.1 |
| draytek vigor1000b_firmware | v < 4.3.1.1 | 4.3.1.1 |
| draytek vigor2962_firmware | v < 4.3.1.1 | 4.3.1.1 |
| draytek vigor2962p_firmware | v < 4.3.1.1 | 4.3.1.1 |
| draytek vigor2927_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2927ax_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2927ac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2927vac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2927l_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2927lac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2915_firmware | v < 4.3.3.2 | 4.3.3.2 |
| draytek vigor2915ac_firmware | v < 4.3.3.2 | 4.3.3.2 |
| draytek vigor2952_firmware | v < 3.9.7.2 | 3.9.7.2 |
| draytek vigor2952p_firmware | v < 3.9.7.2 | 3.9.7.2 |
| draytek vigor3220_firmware | v < 3.9.7.2 | 3.9.7.2 |
| draytek vigor2926_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2926n_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2926ac_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2926vac_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2926l_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2926ln_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2926lac_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862n_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862ac_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862vac_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862b_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862bn_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862l_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862ln_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2862lac_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2620l_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2620ln_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigorlte_200n_firmware | v < 3.9.8.1 | 3.9.8.1 |
| draytek vigor2133_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2133n_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2133ac_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2133vac_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2133fvac_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2762_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2762n_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2762ac_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor2762vac_firmware | v < 3.9.6.4 | 3.9.6.4 |
| draytek vigor165_firmware | v < 4.2.4 | 4.2.4 |
| draytek vigor166_firmware | v < 4.2.4 | 4.2.4 |
| draytek vigor2135_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2135ac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2135vac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2135fvac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2765_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2765ac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2765vac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2766_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2766ac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2766vac_firmware | v < 4.4.2 | 4.4.2 |
| draytek vigor2832_firmware | v < 3.9.6 | 3.9.6 |
| draytek vigor2865_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2865ax_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2865ac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2865vac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2865l_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2865lac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2866_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2866ax_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2866ac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2866vac_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2866l_firmware | v < 4.4.0 | 4.4.0 |
| draytek vigor2866lac_firmware | v < 4.4.0 | 4.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.