CVE-2022-32548

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
mitreCNA
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
draytekvigor3910_firmware
𝑥
< 4.3.1.1
draytekvigor1000b_firmware
𝑥
< 4.3.1.1
draytekvigor2962_firmware
𝑥
< 4.3.1.1
draytekvigor2962p_firmware
𝑥
< 4.3.1.1
draytekvigor2927_firmware
𝑥
< 4.4.0
draytekvigor2927ax_firmware
𝑥
< 4.4.0
draytekvigor2927ac_firmware
𝑥
< 4.4.0
draytekvigor2927vac_firmware
𝑥
< 4.4.0
draytekvigor2927l_firmware
𝑥
< 4.4.0
draytekvigor2927lac_firmware
𝑥
< 4.4.0
draytekvigor2915_firmware
𝑥
< 4.3.3.2
draytekvigor2915ac_firmware
𝑥
< 4.3.3.2
draytekvigor2952_firmware
𝑥
< 3.9.7.2
draytekvigor2952p_firmware
𝑥
< 3.9.7.2
draytekvigor3220_firmware
𝑥
< 3.9.7.2
draytekvigor2926_firmware
𝑥
< 3.9.8.1
draytekvigor2926n_firmware
𝑥
< 3.9.8.1
draytekvigor2926ac_firmware
𝑥
< 3.9.8.1
draytekvigor2926vac_firmware
𝑥
< 3.9.8.1
draytekvigor2926l_firmware
𝑥
< 3.9.8.1
draytekvigor2926ln_firmware
𝑥
< 3.9.8.1
draytekvigor2926lac_firmware
𝑥
< 3.9.8.1
draytekvigor2862_firmware
𝑥
< 3.9.8.1
draytekvigor2862n_firmware
𝑥
< 3.9.8.1
draytekvigor2862ac_firmware
𝑥
< 3.9.8.1
draytekvigor2862vac_firmware
𝑥
< 3.9.8.1
draytekvigor2862b_firmware
𝑥
< 3.9.8.1
draytekvigor2862bn_firmware
𝑥
< 3.9.8.1
draytekvigor2862l_firmware
𝑥
< 3.9.8.1
draytekvigor2862ln_firmware
𝑥
< 3.9.8.1
draytekvigor2862lac_firmware
𝑥
< 3.9.8.1
draytekvigor2620l_firmware
𝑥
< 3.9.8.1
draytekvigor2620ln_firmware
𝑥
< 3.9.8.1
draytekvigorlte_200n_firmware
𝑥
< 3.9.8.1
draytekvigor2133_firmware
𝑥
< 3.9.6.4
draytekvigor2133n_firmware
𝑥
< 3.9.6.4
draytekvigor2133ac_firmware
𝑥
< 3.9.6.4
draytekvigor2133vac_firmware
𝑥
< 3.9.6.4
draytekvigor2133fvac_firmware
𝑥
< 3.9.6.4
draytekvigor2762_firmware
𝑥
< 3.9.6.4
draytekvigor2762n_firmware
𝑥
< 3.9.6.4
draytekvigor2762ac_firmware
𝑥
< 3.9.6.4
draytekvigor2762vac_firmware
𝑥
< 3.9.6.4
draytekvigor165_firmware
𝑥
< 4.2.4
draytekvigor166_firmware
𝑥
< 4.2.4
draytekvigor2135_firmware
𝑥
< 4.4.2
draytekvigor2135ac_firmware
𝑥
< 4.4.2
draytekvigor2135vac_firmware
𝑥
< 4.4.2
draytekvigor2135fvac_firmware
𝑥
< 4.4.2
draytekvigor2765_firmware
𝑥
< 4.4.2
draytekvigor2765ac_firmware
𝑥
< 4.4.2
draytekvigor2765vac_firmware
𝑥
< 4.4.2
draytekvigor2766_firmware
𝑥
< 4.4.2
draytekvigor2766ac_firmware
𝑥
< 4.4.2
draytekvigor2766vac_firmware
𝑥
< 4.4.2
draytekvigor2832_firmware
𝑥
< 3.9.6
draytekvigor2865_firmware
𝑥
< 4.4.0
draytekvigor2865ax_firmware
𝑥
< 4.4.0
draytekvigor2865ac_firmware
𝑥
< 4.4.0
draytekvigor2865vac_firmware
𝑥
< 4.4.0
draytekvigor2865l_firmware
𝑥
< 4.4.0
draytekvigor2865lac_firmware
𝑥
< 4.4.0
draytekvigor2866_firmware
𝑥
< 4.4.0
draytekvigor2866ax_firmware
𝑥
< 4.4.0
draytekvigor2866ac_firmware
𝑥
< 4.4.0
draytekvigor2866vac_firmware
𝑥
< 4.4.0
draytekvigor2866l_firmware
𝑥
< 4.4.0
draytekvigor2866lac_firmware
𝑥
< 4.4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html
https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html