CVE-2023-23313
Medium
Description
Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Draytek Vigor2832 Firmware
PublishedMar 3, 2023
First seenMar 3, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- draytek vigor2832_firmware3.9.6.3 or later
- draytek vigor2860_firmware3.9.4 or later
- draytek vigor2860n_firmware3.9.4 or later
- draytek vigor2860n-plus_firmware3.9.4 or later
- draytek vigor2860vn-plus_firmware3.9.4 or later
- draytek vigor2860ac_firmware3.9.4 or later
- draytek vigor2860vac_firmware3.9.4 or later
- draytek vigor2860l_firmware3.9.4 or later
- draytek vigor2860ln_firmware3.9.4 or later
- draytek vigor2832n_firmware3.9.6.3 or later
- draytek vigor2766_firmware4.4.2.1 or later
- draytek vigor2766ax_firmware4.4.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| draytek vigor2832_firmware | v < 3.9.6.3 | 3.9.6.3 |
| draytek vigor2860_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860n_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860n-plus_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860vn-plus_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860ac_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860vac_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860l_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2860ln_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2832n_firmware | v < 3.9.6.3 | 3.9.6.3 |
| draytek vigor2766_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2766ax_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2766ac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2766vac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2765_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2765ax_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2765ac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2765va_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2763_firmware | v < 4.4.2.2 | 4.4.2.2 |
| draytek vigor2763ac_firmware | v < 4.4.2.2 | 4.4.2.2 |
| draytek vigor2762_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2762n_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2762ac_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2762vac_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2135_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2135ax_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2135ac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2135vac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2135fvac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2133_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2133n_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2133ac_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2133vac_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor2133fvac_firmware | v < 3.9.6.5 | 3.9.6.5 |
| draytek vigor166_firmware | v < 4.2.4.1 | 4.2.4.1 |
| draytek vigor165_firmware | v < 4.2.4.1 | 4.2.4.1 |
| draytek vigor130_firmware | v < 3.8.5.1 | 3.8.5.1 |
| draytek vigornic_132_firmware | v < 3.8.5.1 | 3.8.5.1 |
| draytek vigor3910_firmware | v < 4.3.2.2 | 4.3.2.2 |
| draytek vigor3220_firmware | v < 3.9.7.4 | 3.9.7.4 |
| draytek vigor2962_firmware | v < 4.3.2.2 | 4.3.2.2 |
| draytek vigor2962p_firmware | v < 4.3.2.2 | 4.3.2.2 |
| draytek vigor1000b_firmware | v < 4.3.2.2 | 4.3.2.2 |
| draytek vigor2952_firmware | v < 3.9.7.4 | 3.9.7.4 |
| draytek vigor2952p_firmware | v < 3.9.7.4 | 3.9.7.4 |
| draytek vigor2927_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2927ax_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2927ac_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2927vac_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2927f_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2927l_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2927lac_firmware | v < 4.4.2.3 | 4.4.2.3 |
| draytek vigor2926_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2926n_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2926ac_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2926vac_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2926l_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2926ln_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2926lac_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2925_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925n_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925n-plus_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925vn-plus_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925ac_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925vac_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925fn_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925l_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2925ln_firmware | v < 3.9.4 | 3.9.4 |
| draytek vigor2915_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2915ac_firmware | v < 4.4.2.1 | 4.4.2.1 |
| draytek vigor2866_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2866ax_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2866ac_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2866vac_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2866l_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2866lac_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2865_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2865ax_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2865ac_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2865vac_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2865l_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2865lac_firmware | v < 4.4.1.1 | 4.4.1.1 |
| draytek vigor2862_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862n_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862ac_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862vac_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862b_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862bn_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862l_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862ln_firmware | v < 3.9.9.1 | 3.9.9.1 |
| draytek vigor2862lac_firmware | v < 3.9.9.1 | 3.9.9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.