Lucene search

[email protected]CVE-2022-32548

HistoryAug 29, 2022 - 6:15 a.m.

CVE-2022-32548

2022-08-2906:15:00

CWE-120

[email protected]

web.nvd.nist.gov

116

cve-2022-32548

draytek vigor

router

buffer overflow

security vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

55.2%

JSON

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

CPENameOperatorVersion
draytek:vigor3910_firmwaredraytek vigor3910 firmwarelt4.3.1.1
draytek:vigor1000b_firmwaredraytek vigor1000b firmwarelt4.3.1.1
draytek:vigor2962_firmwaredraytek vigor2962 firmwarelt4.3.1.1
draytek:vigor2962p_firmwaredraytek vigor2962p firmwarelt4.3.1.1
draytek:vigor2927_firmwaredraytek vigor2927 firmwarelt4.4.0
draytek:vigor2927ax_firmwaredraytek vigor2927ax firmwarelt4.4.0
draytek:vigor2927ac_firmwaredraytek vigor2927ac firmwarelt4.4.0
draytek:vigor2927vac_firmwaredraytek vigor2927vac firmwarelt4.4.0
draytek:vigor2927l_firmwaredraytek vigor2927l firmwarelt4.4.0
draytek:vigor2927lac_firmwaredraytek vigor2927lac firmwarelt4.4.0

CPE	Name	Operator	Version
draytek:vigor3910_firmware	draytek vigor3910 firmware	lt	4.3.1.1
draytek:vigor1000b_firmware	draytek vigor1000b firmware	lt	4.3.1.1
draytek:vigor2962_firmware	draytek vigor2962 firmware	lt	4.3.1.1
draytek:vigor2962p_firmware	draytek vigor2962p firmware	lt	4.3.1.1
draytek:vigor2927_firmware	draytek vigor2927 firmware	lt	4.4.0
draytek:vigor2927ax_firmware	draytek vigor2927ax firmware	lt	4.4.0
draytek:vigor2927ac_firmware	draytek vigor2927ac firmware	lt	4.4.0
draytek:vigor2927vac_firmware	draytek vigor2927vac firmware	lt	4.4.0
draytek:vigor2927l_firmware	draytek vigor2927l firmware	lt	4.4.0
draytek:vigor2927lac_firmware	draytek vigor2927lac firmware	lt	4.4.0

Rows per page:

1-10 of 681

References

www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers

www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

55.2%

JSON

Related for CVE-2022-32548

githubexploit14 trellix4 thn1 checkpoint_advisories1 prion1