CVE-2023-33778: DrayTek Myvigor

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

Affected products

  • DrayTek Myvigor: before 2.3.2 (fixed in 2.3.2)
  • DrayTek VIGOR1000B Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR130 Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR165 Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR166 Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR167 Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2135AC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2135AX Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2135FVAC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2135VAC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2620L Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2620LN Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2763AC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2765AC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2765AX Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2765VAC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2766AC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2766AX Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2766VAC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2832N Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2862AC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2862B Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2862BN Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2862L Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • DrayTek VIGOR2862LAC Firmware: before 3.9.6 (fixed in 3.9.6); from 4.0.0, before 4.2.4 (fixed in 4.2.4)
  • and 47 more

Published 2023-06-01. Last modified 2026-06-17.