Vulnerability-Lookup

BDU:2024-11413 (CVE-2023-33778)

Vulnerability from fstec – Published: 2024-12-23 – Updated: 2024-12-23 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость веб-интерфейса микропрограммного обеспечения маршрутизаторов Draytek Vigor Routers, точек доступа Draytek Vigor Access Points, коммутаторов Draytek Vigor Switches и облачной платформы Draytek Vigor Myvigor, связанная с использованием жестко закодированных учетных данных, позволяющая нарушителю оказывать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость веб-интерфейса микропрограммного обеспечения маршрутизаторов Draytek Vigor Routers, точек доступа Draytek Vigor Access Points, коммутаторов Draytek Vigor Switches и облачной платформы Draytek Vigor Myvigor связана с использованием жестко закодированных учетных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказывать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Authentication bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-798 - Жесткое кодирование регистрационных данных

Aliases

CVE-2023-33778

References

1 reference

URL
https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef

Impacted products

72 products from 1 vendor

Vendors

DrayTek

Products

Vigor Switch Pq2200xb, Myvigor, Vigor Switch Pq2121x, Vigor Switch P2540xs, Vigor Switch P2280x, Vigor Switch P2100, Vigor Switch Q2200x, Vigor Switch Q2121x, Vigor Switch G2540xs, Vigor Switch G2280x, Vigor Switch G2121, Vigor Switch G2100, Vigor Switch Fx2120, Vigor Switch P1282, Vigor Switch G1282, Vigor Switch G1085, Vigor Switch G1080, VigorAP 903, VigorAP 912C, VigorAP 918R, VigorAp 1060C, VigorAp 906, VigorAp 960C, VigorAP 1000C, Vigor 2766ac, Vigor 2766ax, Vigor 2766vac, Vigor 2765ax, Vigor 2765vac, Vigor 2765ac, Vigor 2763ac, Vigor 2620l, Vigor 2620ln, Vigor LTE 200n, Vigor 2915ac, Vigor 2135ac, Vigor 2135ax, Vigor 2135fvac, Vigor 2135vac, Vigor 2866ax, Vigor 2866vac, Vigor 2866ac, Vigor 2866l, Vigor 2866lac, Vigor 2865ac, Vigor 2865ax, Vigor 2865vac, Vigor 2865l, Vigor 2865lac, Vigor 2862n, Vigor 2862ac, Vigor 2862vac, Vigor 2862b, Vigor 2862bn, Vigor 2862l, Vigor 2862lac, Vigor 2862ln, Vigor 2832n, Vigor 2927ax, Vigor 2927ac, Vigor 2927vac, Vigor 2927f, Vigor 2927l, Vigor 2927lac, Vigor 2926, Vigor 2962, Vigor 1000B, Vigor 3910, Vigor 165, Vigor 166, Vigor 130, Vigor 167

Versions

до 2.6.7 (Vigor Switch Pq2200xb), до 2.3.2 (Myvigor), до 2.6.7 (Vigor Switch Pq2121x), до 2.6.7 (Vigor Switch P2540xs), до 2.6.7 (Vigor Switch P2280x), до 2.6.7 (Vigor Switch P2100), до 2.6.7 (Vigor Switch Q2200x), до 2.6.7 (Vigor Switch Q2121x), до 2.6.7 (Vigor Switch G2540xs), до 2.6.7 (Vigor Switch G2280x), до 2.6.7 (Vigor Switch G2121), до 2.6.7 (Vigor Switch G2100), до 2.6.7 (Vigor Switch Fx2120), до 2.6.7 (Vigor Switch P1282), до 2.6.7 (Vigor Switch G1282), до 2.6.7 (Vigor Switch G1085), до 2.6.7 (Vigor Switch G1080), до 1.4.0 (VigorAP 903), до 1.4.0 (VigorAP 912C), до 1.4.0 (VigorAP 918R), до 1.4.0 (VigorAp 1060C), до 1.4.0 (VigorAp 906), до 1.4.0 (VigorAp 960C), до 1.4.0 (VigorAP 1000C), до 3.9.6 (Vigor 2766ac), от 4.0.0 до 4.2.4 (Vigor 2766ac), до 3.9.6 (Vigor 2766ax), от 4.0.0 до 4.2.4 (Vigor 2766ax), до 3.9.6 (Vigor 2766vac), от 4.0.0 до 4.2.4 (Vigor 2766vac), до 3.9.6 (Vigor 2765ax), от 4.0.0 до 4.2.4 (Vigor 2765ax), до 3.9.6 (Vigor 2765vac), от 4.0.0 до 4.2.4 (Vigor 2765vac), до 3.9.6 (Vigor 2765ac), от 4.0.0 до 4.2.4 (Vigor 2765ac), до 3.9.6 (Vigor 2763ac), от 4.0.0 до 4.2.4 (Vigor 2763ac), до 3.9.6 (Vigor 2620l), от 4.0.0 до 4.2.4 (Vigor 2620l), до 3.9.6 (Vigor 2620ln), от 4.0.0 до 4.2.4 (Vigor 2620ln), до 3.9.6 (Vigor LTE 200n), от 4.0.0 до 4.2.4 (Vigor LTE 200n), до 3.9.6 (Vigor 2915ac), от 4.0.0 до 4.2.4 (Vigor 2915ac), до 3.9.6 (Vigor 2135ac), от 4.0.0 до 4.2.4 (Vigor 2135ac), до 3.9.6 (Vigor 2135ax), от 4.0.0 до 4.2.4 (Vigor 2135ax), до 3.9.6 (Vigor 2135fvac), от 4.0.0 до 4.2.4 (Vigor 2135fvac), до 3.9.6 (Vigor 2135vac), от 4.0.0 до 4.2.4 (Vigor 2135vac), до 3.9.6 (Vigor 2866ax), от 4.0.0 до 4.2.4 (Vigor 2866ax), до 3.9.6 (Vigor 2866vac), от 4.0.0 до 4.2.4 (Vigor 2866vac), до 3.9.6 (Vigor 2866ac), от 4.0.0 до 4.2.4 (Vigor 2866ac), до 3.9.6 (Vigor 2866l), от 4.0.0 до 4.2.4 (Vigor 2866l), до 3.9.6 (Vigor 2866lac), от 4.0.0 до 4.2.4 (Vigor 2866lac), до 3.9.6 (Vigor 2865ac), от 4.0.0 до 4.2.4 (Vigor 2865ac), до 3.9.5 (Vigor 2865ax), от 4.0.0 до 4.2.4 (Vigor 2865ax), до 3.9.6 (Vigor 2865vac), от 4.0.0 до 4.2.4 (Vigor 2865vac), до 3.9.6 (Vigor 2865l), от 4.0.0 до 4.2.4 (Vigor 2865l), до 3.9.6 (Vigor 2865lac), от 4.0.0 до 4.2.4 (Vigor 2865lac), до 3.9.6 (Vigor 2862n), от 4.0.0 до 4.2.4 (Vigor 2862n), до 3.9.6 (Vigor 2862ac), от 4.0.0 до 4.2.4 (Vigor 2862ac), до 3.9.6 (Vigor 2862vac), от 4.0.0 до 4.2.4 (Vigor 2862vac), до 3.9.6 (Vigor 2862b), от 4.0.0 до 4.2.4 (Vigor 2862b), до 3.9.6 (Vigor 2862bn), от 4.0.0 до 4.2.4 (Vigor 2862bn), до 3.9.6 (Vigor 2862l), от 4.0.0 до 4.2.4 (Vigor 2862l), до 3.9.6 (Vigor 2862lac), от 4.0.0 до 4.2.4 (Vigor 2862lac), до 3.9.6 (Vigor 2862ln), от 4.0.0 до 4.2.4 (Vigor 2862ln), до 3.9.6 (Vigor 2832n), от 4.0.0 до 4.2.4 (Vigor 2832n), до 3.9.6 (Vigor 2927ax), от 4.0.0 до 4.2.4 (Vigor 2927ax), до 3.9.6 (Vigor 2927ac), от 4.0.0 до 4.2.4 (Vigor 2927ac), до 3.9.6 (Vigor 2927vac), от 4.0.0 до 4.2.4 (Vigor 2927vac), до 3.9.6 (Vigor 2927f), от 4.0.0 до 4.2.4 (Vigor 2927f), до 3.9.6 (Vigor 2927l), от 4.0.0 до 4.2.4 (Vigor 2927l), до 3.9.6 (Vigor 2927lac), от 4.0.0 до 4.2.4 (Vigor 2927lac), до 3.9.6 (Vigor 2926), от 4.0.0 до 4.2.4 (Vigor 2926), до 3.9.6 (Vigor 2962), от 4.0.0 до 4.2.4 (Vigor 2962), до 3.9.6 (Vigor 1000B), от 4.0.0 до 4.2.4 (Vigor 1000B), до 3.9.6 (Vigor 3910), от 4.0.0 до 4.2.4 (Vigor 3910), до 3.9.6 (Vigor 165), от 4.0.0 до 4.2.4 (Vigor 165), до 3.9.6 (Vigor 166), от 4.0.0 до 4.2.4 (Vigor 166), до 3.9.6 (Vigor 130), от 4.0.0 до 4.2.4 (Vigor 130), до 3.9.6 (Vigor 167), от 4.0.0 до 4.2.4 (Vigor 167)

Product types

Network device, Network software, Network appliance software

Mitigations

Использование рекомендаций: https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "DrayTek",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2.6.7 (Vigor Switch Pq2200xb), \u0434\u043e 2.3.2 (Myvigor), \u0434\u043e 2.6.7 (Vigor Switch Pq2121x), \u0434\u043e 2.6.7 (Vigor Switch P2540xs), \u0434\u043e 2.6.7 (Vigor Switch P2280x), \u0434\u043e 2.6.7 (Vigor Switch P2100), \u0434\u043e 2.6.7 (Vigor Switch Q2200x), \u0434\u043e 2.6.7 (Vigor Switch Q2121x), \u0434\u043e 2.6.7 (Vigor Switch G2540xs), \u0434\u043e 2.6.7 (Vigor Switch G2280x), \u0434\u043e 2.6.7 (Vigor Switch G2121), \u0434\u043e 2.6.7 (Vigor Switch G2100), \u0434\u043e 2.6.7 (Vigor Switch Fx2120), \u0434\u043e 2.6.7 (Vigor Switch P1282), \u0434\u043e 2.6.7 (Vigor Switch G1282), \u0434\u043e 2.6.7 (Vigor Switch G1085), \u0434\u043e 2.6.7 (Vigor Switch G1080), \u0434\u043e 1.4.0 (VigorAP 903), \u0434\u043e 1.4.0 (VigorAP 912C), \u0434\u043e 1.4.0 (VigorAP 918R), \u0434\u043e 1.4.0 (VigorAp 1060C), \u0434\u043e 1.4.0 (VigorAp 906), \u0434\u043e 1.4.0 (VigorAp 960C), \u0434\u043e 1.4.0 (VigorAP 1000C), \u0434\u043e 3.9.6 (Vigor 2766ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2766ac), \u0434\u043e 3.9.6 (Vigor 2766ax), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2766ax), \u0434\u043e 3.9.6 (Vigor 2766vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2766vac), \u0434\u043e 3.9.6 (Vigor 2765ax), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2765ax), \u0434\u043e 3.9.6 (Vigor 2765vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2765vac), \u0434\u043e 3.9.6 (Vigor 2765ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2765ac), \u0434\u043e 3.9.6 (Vigor 2763ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2763ac), \u0434\u043e 3.9.6 (Vigor 2620l), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2620l), \u0434\u043e 3.9.6 (Vigor 2620ln), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2620ln), \u0434\u043e 3.9.6 (Vigor LTE 200n), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor LTE 200n), \u0434\u043e 3.9.6 (Vigor 2915ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2915ac), \u0434\u043e 3.9.6 (Vigor 2135ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2135ac), \u0434\u043e 3.9.6 (Vigor 2135ax), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2135ax), \u0434\u043e 3.9.6 (Vigor 2135fvac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2135fvac), \u0434\u043e 3.9.6 (Vigor 2135vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2135vac), \u0434\u043e 3.9.6 (Vigor 2866ax), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2866ax), \u0434\u043e 3.9.6 (Vigor 2866vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2866vac), \u0434\u043e 3.9.6 (Vigor 2866ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2866ac), \u0434\u043e 3.9.6 (Vigor 2866l), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2866l), \u0434\u043e 3.9.6 (Vigor 2866lac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2866lac), \u0434\u043e 3.9.6 (Vigor 2865ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2865ac), \u0434\u043e 3.9.5 (Vigor 2865ax), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2865ax), \u0434\u043e 3.9.6 (Vigor 2865vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2865vac), \u0434\u043e 3.9.6 (Vigor 2865l), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2865l), \u0434\u043e 3.9.6 (Vigor 2865lac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2865lac), \u0434\u043e 3.9.6 (Vigor 2862n), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862n), \u0434\u043e 3.9.6 (Vigor 2862ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862ac), \u0434\u043e 3.9.6 (Vigor 2862vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862vac), \u0434\u043e 3.9.6 (Vigor 2862b), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862b), \u0434\u043e 3.9.6 (Vigor 2862bn), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862bn), \u0434\u043e 3.9.6 (Vigor 2862l), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862l), \u0434\u043e 3.9.6 (Vigor 2862lac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862lac), \u0434\u043e 3.9.6 (Vigor 2862ln), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2862ln), \u0434\u043e 3.9.6 (Vigor 2832n), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2832n), \u0434\u043e 3.9.6 (Vigor 2927ax), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2927ax), \u0434\u043e 3.9.6 (Vigor 2927ac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2927ac), \u0434\u043e 3.9.6 (Vigor 2927vac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2927vac), \u0434\u043e 3.9.6 (Vigor 2927f), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2927f), \u0434\u043e 3.9.6 (Vigor 2927l), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2927l), \u0434\u043e 3.9.6 (Vigor 2927lac), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2927lac), \u0434\u043e 3.9.6 (Vigor 2926), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2926), \u0434\u043e 3.9.6 (Vigor 2962), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 2962), \u0434\u043e 3.9.6 (Vigor 1000B), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 1000B), \u0434\u043e 3.9.6 (Vigor 3910), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 3910), \u0434\u043e 3.9.6 (Vigor 165), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 165), \u0434\u043e 3.9.6 (Vigor 166), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 166), \u0434\u043e 3.9.6 (Vigor 130), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 130), \u0434\u043e 3.9.6 (Vigor 167), \u043e\u0442 4.0.0 \u0434\u043e 4.2.4 (Vigor 167)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "01.06.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.12.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "23.12.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-11413",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-33778",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Vigor Switch Pq2200xb, Myvigor, Vigor Switch Pq2121x, Vigor Switch P2540xs, Vigor Switch P2280x, Vigor Switch P2100, Vigor Switch Q2200x, Vigor Switch Q2121x, Vigor Switch G2540xs, Vigor Switch G2280x, Vigor Switch G2121, Vigor Switch G2100, Vigor Switch Fx2120, Vigor Switch P1282, Vigor Switch G1282, Vigor Switch G1085, Vigor Switch G1080, VigorAP 903, VigorAP 912C, VigorAP 918R, VigorAp 1060C, VigorAp 906, VigorAp 960C, VigorAP 1000C, Vigor 2766ac, Vigor 2766ax, Vigor 2766vac, Vigor 2765ax, Vigor 2765vac, Vigor 2765ac, Vigor 2763ac, Vigor 2620l, Vigor 2620ln, Vigor LTE 200n, Vigor 2915ac, Vigor 2135ac, Vigor 2135ax, Vigor 2135fvac, Vigor 2135vac, Vigor 2866ax, Vigor 2866vac, Vigor 2866ac, Vigor 2866l, Vigor 2866lac, Vigor 2865ac, Vigor 2865ax, Vigor 2865vac, Vigor 2865l, Vigor 2865lac, Vigor 2862n, Vigor 2862ac, Vigor 2862vac, Vigor 2862b, Vigor 2862bn, Vigor 2862l, Vigor 2862lac, Vigor 2862ln, Vigor 2832n, Vigor 2927ax, Vigor 2927ac, Vigor 2927vac, Vigor 2927f, Vigor 2927l, Vigor 2927lac, Vigor 2926, Vigor 2962, Vigor 1000B, Vigor 3910, Vigor 165, Vigor 166, Vigor 130, Vigor 167",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f  \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Draytek Vigor Routers, \u0442\u043e\u0447\u0435\u043a \u0434\u043e\u0441\u0442\u0443\u043f\u0430 Draytek Vigor Access Points, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 Draytek Vigor Switches \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Draytek Vigor Myvigor, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0416\u0435\u0441\u0442\u043a\u043e\u0435 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-798)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f  \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Draytek Vigor Routers, \u0442\u043e\u0447\u0435\u043a \u0434\u043e\u0441\u0442\u0443\u043f\u0430 Draytek Vigor Access Points, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 Draytek Vigor Switches \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Draytek Vigor Myvigor \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-798",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CVE-2023-33778 (GCVE-0-2023-33778)

Vulnerability from cvelistv5 – Published: 2023-06-01 00:00 – Updated: 2025-01-09 17:24

Summary

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-09 17:24 UTC

CWE

n/a
CWE-798 - Use of Hard-coded Credentials

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://gist.github.com/Ji4n1ng/6d028709d39458f5a…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:47:06.496Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-33778",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T17:24:27.672008Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-798",
                "description": "CWE-798 Use of Hard-coded Credentials",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T17:24:35.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-01T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-33778",
    "datePublished": "2023-06-01T00:00:00.000Z",
    "dateReserved": "2023-05-22T00:00:00.000Z",
    "dateUpdated": "2025-01-09T17:24:35.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2024-11413 (CVE-2023-33778)

CVE-2023-33778 (GCVE-0-2023-33778)

Tags

Sightings

Nomenclature

Related by attack behaviour