DrayTek VIGOR2862VAC Firmware vulnerabilities

3 CVEs affecting DrayTek VIGOR2862VAC Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33778, published 2023-06-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-32548, published 2022-08-29. Critical severity, CVSS 9.8. EPSS: 34% chance of exploitation in the next 30 days. An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab…
CVE-2023-33778, published 2023-06-01. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were…
CVE-2023-23313, published 2023-03-03. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910,…