CVE-2022-32548

Katalog CVE

CVSS 9.8 · Critical EPSS 34,0%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada draytek vigor3910 firmware, draytek vigor1000b firmware +58 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

Rincian

Terbit di NVD

29 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

34,0% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 68 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers exploit · advisory pihak ketiga
• https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html exploit · advisory pihak ketiga