CVE-2022-32548: DrayTek VIGOR1000B Firmware

Critical severity, CVSS 9.8. EPSS: 34% chance of exploitation in the next 30 days.

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

Affected products

DrayTek VIGOR1000B Firmware: before 4.3.1.1 (fixed in 4.3.1.1)
DrayTek VIGOR165 Firmware: before 4.2.4 (fixed in 4.2.4)
DrayTek VIGOR166 Firmware: before 4.2.4 (fixed in 4.2.4)
DrayTek VIGOR2133 Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2133AC Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2133FVAC Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2133N Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2133VAC Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2135 Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2135AC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2135FVAC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2135VAC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2620L Firmware: before 3.9.8.1 (fixed in 3.9.8.1)
DrayTek VIGOR2620LN Firmware: before 3.9.8.1 (fixed in 3.9.8.1)
DrayTek VIGOR2762 Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2762AC Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2762N Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2762VAC Firmware: before 3.9.6.4 (fixed in 3.9.6.4)
DrayTek VIGOR2765 Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2765AC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2765VAC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2766 Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2766AC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2766VAC Firmware: before 4.4.2 (fixed in 4.4.2)
DrayTek VIGOR2832 Firmware: before 3.9.6 (fixed in 3.9.6)
and 43 more

Published 2022-08-29. Last modified 2026-06-17.