CVE-2022-32548

CVE-2022-32548 affects DrayTek Vigor routers (e.g., Vigor3910) with firmware prior to 4.3.1.1. The vulnerability is a buffer overflow in the web management interface at /cgi-bin/wlogin.cgi triggered by crafted input in the username or password fields (aa/ab), enabling unauthenticated remote code ...

CVE-2023-23313

CVE-2023-23313 affects DrayTek Vigor routers via XSS in the wlogin.cgi and user_login.cgi web portal scripts. Affected models span multiple series and firmware versions (e.g., Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865/2866 v4.4.1.0; Vigor2927 v4.4.2.2; Vigor2915, Vigor2765/2766/2135 v4...

CVE-2023-33778

Summary: CVE-2023-33778 relates to Draytek Vigor devices (Routers, Access Points, Switches, Myvigor) that ship with hardcoded encryption keys. This flaw lets an attacker bind an affected device to their own account and subsequently create WCF and DrayDDNS licenses and synchronize them from the we...