CVEvulnerability

CVE-2023-23313

6.1 MEDIUM Published 2023-03-03 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2023-03-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.

Affected configurations

• draytek vigor2860 firmware (< 3.9.4) • draytek vigor2860n firmware (< 3.9.4) • draytek vigor2860n-plus firmware (< 3.9.4) • draytek vigor2860vn-plus firmware (< 3.9.4) • draytek vigor2860ac firmware (< 3.9.4) • draytek vigor2860vac firmware (< 3.9.4) • draytek vigor2860l firmware (< 3.9.4) • draytek vigor2860ln firmware (< 3.9.4) • draytek vigor2832 firmware (< 3.9.6.3) • draytek vigor2832n firmware (< 3.9.6.3) • draytek vigor2766 firmware (< 4.4.2.1) • draytek vigor2766ax firmware (< 4.4.2.1) • draytek vigor2766ac firmware (< 4.4.2.1) • draytek vigor2766vac firmware (< 4.4.2.1) • draytek vigor2765 firmware (< 4.4.2.1) • draytek vigor2765ax firmware (< 4.4.2.1) • draytek vigor2765ac firmware (< 4.4.2.1) • draytek vigor2765va firmware (< 4.4.2.1) • draytek vigor2763 firmware (< 4.4.2.2) • draytek vigor2763ac firmware (< 4.4.2.2) • draytek vigor2762 firmware (< 3.9.6.5) • draytek vigor2762n firmware (< 3.9.6.5) • draytek vigor2762ac firmware (< 3.9.6.5) • draytek vigor2762vac firmware (< 3.9.6.5) • draytek vigor2135 firmware (< 4.4.2.1) • draytek vigor2135ax firmware (< 4.4.2.1) • draytek vigor2135ac firmware (< 4.4.2.1) • draytek vigor2135vac firmware (< 4.4.2.1) • draytek vigor2135fvac firmware (< 4.4.2.1) • draytek vigor2133 firmware (< 3.9.6.5) • draytek vigor2133n firmware (< 3.9.6.5) • draytek vigor2133ac firmware (< 3.9.6.5) • draytek vigor2133vac firmware (< 3.9.6.5) • draytek vigor2133fvac firmware (< 3.9.6.5) • draytek vigor166 firmware (< 4.2.4.1) • draytek vigor165 firmware (< 4.2.4.1) • draytek vigor130 firmware (< 3.8.5.1) • draytek vigornic 132 firmware (< 3.8.5.1) • draytek vigor3910 firmware (< 4.3.2.2) • draytek vigor3220 firmware (< 3.9.7.4) • draytek vigor2962 firmware (< 4.3.2.2) • draytek vigor2962p firmware (< 4.3.2.2) • draytek vigor1000b firmware (< 4.3.2.2) • draytek vigor2952 firmware (< 3.9.7.4) • draytek vigor2952p firmware (< 3.9.7.4) • draytek vigor2927 firmware (< 4.4.2.3) • draytek vigor2927ax firmware (< 4.4.2.3) • draytek vigor2927ac firmware (< 4.4.2.3) • draytek vigor2927vac firmware (< 4.4.2.3) • draytek vigor2927f firmware (< 4.4.2.3) • draytek vigor2927l firmware (< 4.4.2.3) • draytek vigor2927lac firmware (< 4.4.2.3) • draytek vigor2926 firmware (< 3.9.9.1) • draytek vigor2926n firmware (< 3.9.9.1) • draytek vigor2926ac firmware (< 3.9.9.1) • draytek vigor2926vac firmware (< 3.9.9.1) • draytek vigor2926l firmware (< 3.9.9.1) • draytek vigor2926ln firmware (< 3.9.9.1) • draytek vigor2926lac firmware (< 3.9.9.1) • draytek vigor2925 firmware (< 3.9.4) … and 31 more

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References