Unrated severityNVD Advisory· Published Jun 1, 2023· Updated Jan 9, 2025

CVE-2023-33778

Description

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Draytek/Vigor 2700 Routercpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <3.9.6 / 4.2.4
Draytek/Myvigorllm-create
Range: <2.3.2
Ruckus/Access Pointllm-fuzzy
Range: <v1.4.0
Omada/switchesllm-fuzzy
Range: <2.6.7

Patches

Vulnerability mechanics

References

gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225efmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000