ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2023-33778

PoC —
CVSS 3.1
9.8 critical
EPSS
<1%p47
Published
()
Modified
Description

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

Vendors
draytek
Products
myvigor, vigorswitch pq2200xb firmware, vigorswitch pq2121x firmware, vigorswitch p2540xs firmware, vigorswitch p2280x firmware, vigorswitch p2100 firmware, vigorswitch q2200x firmware, vigorswitch q2121x firmware, vigorswitch g2540xs firmware, vigorswitch g2280x firmware, vigorswitch g2121 firmware, vigorswitch g2100 firmware
Weakness
CWE-798
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

No ingested article mentions this CVE yet.