PT-2023-9803 · Draytek · Draytek Vigor Routers+3

Ji4N1Ng · Publicado 2023-06-01 · Atualizado 2025-01-09 · CVE-2023-33778

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Draytek Vigor Routers versions below 3.9.6/4.2.4 Draytek Vigor Access Points versions below v1.4.0 Draytek Vigor Switches versions below 2.6.7 Draytek Vigor Myvigor versions below 2.3.2

Description The issue is related to the use of hardcoded encryption keys in the firmware of Draytek Vigor devices. This allows attackers to bind any affected device to their own account, enabling them to create WCF and DrayDDNS licenses and synchronize them from the website. The vulnerability can be exploited remotely and may impact the confidentiality, integrity, and availability of protected information.

Recommendations For Draytek Vigor Routers versions below 3.9.6/4.2.4, update to version 3.9.6/4.2.4 or later. For Draytek Vigor Access Points versions below v1.4.0, update to version v1.4.0 or later. For Draytek Vigor Switches versions below 2.6.7, update to version 2.6.7 or later. For Draytek Vigor Myvigor versions below 2.3.2, update to version 2.3.2 or later.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2024-11413

CVE-2023-33778

Produtos afetados

Draytek Vigor Access Points

Draytek Vigor Myvigor

Draytek Vigor Routers

Draytek Vigor Switches

Referências · 6

• 🔥 https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef · Exploit
• https://t.me/cvenotify/106968 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33778 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-11413 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-33778 · Nota de Segurança
• https://t.me/netlas/73 · Publicação no Telegram