CVEvulnerability

CVE-2023-33778

9.8 CRITICAL Published 2023-06-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-06-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-798

Description

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

Affected configurations

• draytek myvigor (< 2.3.2) • draytek vigorswitch pq2200xb firmware (< 2.6.7) • draytek vigorswitch pq2121x firmware (< 2.6.7) • draytek vigorswitch p2540xs firmware (< 2.6.7) • draytek vigorswitch p2280x firmware (< 2.6.7) • draytek vigorswitch p2100 firmware (< 2.6.7) • draytek vigorswitch q2200x firmware (< 2.6.7) • draytek vigorswitch q2121x firmware (< 2.6.7) • draytek vigorswitch g2540xs firmware (< 2.6.7) • draytek vigorswitch g2280x firmware (< 2.6.7) • draytek vigorswitch g2121 firmware (< 2.6.7) • draytek vigorswitch g2100 firmware (< 2.6.7) • draytek vigorswitch fx2120 firmware (< 2.6.7) • draytek vigorswitch p1282 firmware (< 2.6.7) • draytek vigorswitch g1282 firmware (< 2.6.7) • draytek vigorswitch g1085 firmware (< 2.6.7) • draytek vigorswitch g1080 firmware (< 2.6.7) • draytek vigorap 903 firmware (< 1.4.0) • draytek vigorap 912c firmware (< 1.4.0) • draytek vigorap 918r firmware (< 1.4.0) • draytek vigorap 1060c firmware (< 1.4.0) • draytek vigorap 906 firmware (< 1.4.0) • draytek vigorap 960c firmware (< 1.4.0) • draytek vigorap 1000c firmware (< 1.4.0) • draytek vigor2766ac firmware (< 3.9.6) • draytek vigor2766ac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2766ax firmware (< 3.9.6) • draytek vigor2766ax firmware (>= 4.0.0 < 4.2.4) • draytek vigor2766vac firmware (< 3.9.6) • draytek vigor2766vac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2765ax firmware (< 3.9.6) • draytek vigor2765ax firmware (>= 4.0.0 < 4.2.4) • draytek vigor2765vac firmware (< 3.9.6) • draytek vigor2765vac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2765ac firmware (< 3.9.6) • draytek vigor2765ac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2763ac firmware (< 3.9.6) • draytek vigor2763ac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2620l firmware (< 3.9.6) • draytek vigor2620l firmware (>= 4.0.0 < 4.2.4) • draytek vigor2620ln firmware (< 3.9.6) • draytek vigor2620ln firmware (>= 4.0.0 < 4.2.4) • draytek vigorlte 200n firmware (< 3.9.6) • draytek vigorlte 200n firmware (>= 4.0.0 < 4.2.4) • draytek vigor2915ac firmware (< 3.9.6) • draytek vigor2915ac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2135ac firmware (< 3.9.6) • draytek vigor2135ac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2135ax firmware (< 3.9.6) • draytek vigor2135ax firmware (>= 4.0.0 < 4.2.4) • draytek vigor2135fvac firmware (< 3.9.6) • draytek vigor2135fvac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2135vac firmware (< 3.9.6) • draytek vigor2135vac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2866ax firmware (< 3.9.6) • draytek vigor2866ax firmware (>= 4.0.0 < 4.2.4) • draytek vigor2866ac firmware (< 3.9.6) • draytek vigor2866ac firmware (>= 4.0.0 < 4.2.4) • draytek vigor2866vac firmware (< 3.9.6) • draytek vigor2866vac firmware (>= 4.0.0 < 4.2.4) … and 60 more

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References