Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-33778: Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were disco...

CVE-2023-33778 · published 3 years ago

Summary

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own ...

What to do

Update draytek myvigor to version 2.3.2 or later.
Update draytek vigorswitch_pq2200xb_firmware to version 2.6.7 or later.
Update draytek vigorswitch_pq2121x_firmware to version 2.6.7 or later.
Update draytek vigorswitch_p2540xs_firmware to version 2.6.7 or later.
Update draytek vigorswitch_p2280x_firmware to version 2.6.7 or later.
Update draytek vigorswitch_p2100_firmware to version 2.6.7 or later.
Update draytek vigorswitch_q2200x_firmware to version 2.6.7 or later.
Update draytek vigorswitch_q2121x_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g2540xs_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g2280x_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g2121_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g2100_firmware to version 2.6.7 or later.
Update draytek vigorswitch_fx2120_firmware to version 2.6.7 or later.
Update draytek vigorswitch_p1282_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g1282_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g1085_firmware to version 2.6.7 or later.
Update draytek vigorswitch_g1080_firmware to version 2.6.7 or later.
Update draytek vigorap_903_firmware to version 1.4.0 or later.
Update draytek vigorap_912c_firmware to version 1.4.0 or later.
Update draytek vigorap_918r_firmware to version 1.4.0 or later.
Update draytek vigorap_1060c_firmware to version 1.4.0 or later.
Update draytek vigorap_906_firmware to version 1.4.0 or later.
Update draytek vigorap_960c_firmware to version 1.4.0 or later.
Update draytek vigorap_1000c_firmware to version 1.4.0 or later.

Affected software

Vendor	Product	Affected versions
draytek	myvigor	< 2.3.2 `cpe:2.3:a:draytek:myvigor::::::::`
draytek	vigorswitch_pq2200xb_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_pq2200xb_firmware::::::::`
draytek	vigorswitch_pq2121x_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_pq2121x_firmware::::::::`
draytek	vigorswitch_p2540xs_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_p2540xs_firmware::::::::`
draytek	vigorswitch_p2280x_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_p2280x_firmware::::::::`
draytek	vigorswitch_p2100_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_p2100_firmware::::::::`
draytek	vigorswitch_q2200x_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_q2200x_firmware::::::::`
draytek	vigorswitch_q2121x_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_q2121x_firmware::::::::`
draytek	vigorswitch_g2540xs_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g2540xs_firmware::::::::`
draytek	vigorswitch_g2280x_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g2280x_firmware::::::::`
draytek	vigorswitch_g2121_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g2121_firmware::::::::`
draytek	vigorswitch_g2100_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g2100_firmware::::::::`
draytek	vigorswitch_fx2120_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_fx2120_firmware::::::::`
draytek	vigorswitch_p1282_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_p1282_firmware::::::::`
draytek	vigorswitch_g1282_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g1282_firmware::::::::`
draytek	vigorswitch_g1085_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g1085_firmware::::::::`
draytek	vigorswitch_g1080_firmware	< 2.6.7 `cpe:2.3:o:draytek:vigorswitch_g1080_firmware::::::::`
draytek	vigorap_903_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_903_firmware::::::::`
draytek	vigorap_912c_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_912c_firmware::::::::`
draytek	vigorap_918r_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_918r_firmware::::::::`
draytek	vigorap_1060c_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_1060c_firmware::::::::`
draytek	vigorap_906_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_906_firmware::::::::`
draytek	vigorap_960c_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_960c_firmware::::::::`
draytek	vigorap_1000c_firmware	< 1.4.0 `cpe:2.3:o:draytek:vigorap_1000c_firmware::::::::`
draytek	vigor2766ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2766ac_firmware::::::::`
draytek	vigor2766ax_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2766ax_firmware::::::::`
draytek	vigor2766vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2766vac_firmware::::::::`
draytek	vigor2765ax_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2765ax_firmware::::::::`
draytek	vigor2765vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2765vac_firmware::::::::`
draytek	vigor2765ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2765ac_firmware::::::::`
draytek	vigor2763ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2763ac_firmware::::::::`
draytek	vigor2620l_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2620l_firmware::::::::`
draytek	vigor2620ln_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2620ln_firmware::::::::`
draytek	vigorlte_200n_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigorlte_200n_firmware::::::::`
draytek	vigor2915ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2915ac_firmware::::::::`
draytek	vigor2135ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2135ac_firmware::::::::`
draytek	vigor2135ax_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2135ax_firmware::::::::`
draytek	vigor2135fvac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2135fvac_firmware::::::::`
draytek	vigor2135vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2135vac_firmware::::::::`
draytek	vigor2866ax_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2866ax_firmware::::::::`
draytek	vigor2866ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2866ac_firmware::::::::`
draytek	vigor2866vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2866vac_firmware::::::::`
draytek	vigor2866l_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2866l_firmware::::::::`
draytek	vigor2866lac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2866lac_firmware::::::::`
draytek	vigor2865ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2865ac_firmware::::::::`
draytek	vigor2865ax_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2865ax_firmware::::::::`
draytek	vigor2865vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2865vac_firmware::::::::`
draytek	vigor2865l_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2865l_firmware::::::::`
draytek	vigor2865lac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2865lac_firmware::::::::`
draytek	vigor2862n_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862n_firmware::::::::`

Showing 50 of 72. Show the rest

Vendor	Product	Affected versions
draytek	vigor2862ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862ac_firmware::::::::`
draytek	vigor2862vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862vac_firmware::::::::`
draytek	vigor2862b_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862b_firmware::::::::`
draytek	vigor2862bn_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862bn_firmware::::::::`
draytek	vigor2862l_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862l_firmware::::::::`
draytek	vigor2862lac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862lac_firmware::::::::`
draytek	vigor2862ln_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2862ln_firmware::::::::`
draytek	vigor2832n_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2832n_firmware::::::::`
draytek	vigor2927ax_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2927ax_firmware::::::::`
draytek	vigor2927ac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2927ac_firmware::::::::`
draytek	vigor2927vac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2927vac_firmware::::::::`
draytek	vigor2927f_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2927f_firmware::::::::`
draytek	vigor2927l_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2927l_firmware::::::::`
draytek	vigor2927lac_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2927lac_firmware::::::::`
draytek	vigor2926_plus_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2926_plus_firmware::::::::`
draytek	vigor2962_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor2962_firmware::::::::`
draytek	vigor1000b_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor1000b_firmware::::::::`
draytek	vigor3910_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor3910_firmware::::::::`
draytek	vigor165_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor165_firmware::::::::`
draytek	vigor166_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor166_firmware::::::::`
draytek	vigor130_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor130_firmware::::::::`
draytek	vigor167_firmware	< 3.9.6 >= 4.0.0, < 4.2.4 `cpe:2.3:o:draytek:vigor167_firmware::::::::`

Original advisory text

References

https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-798Use of Hard-coded Credentials

Timeline

Published1 Jun 2023

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-33778 · NVD

Track software like this

Free during beta