Skip to content
Fencer Vulns
critical 9.8

CVE-2023-33778 json

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2…

published 2023-06-01 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-37930

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

Patch / fix

  • draytek myvigor 2.3.2
  • draytek vigorswitch_pq2200xb_firmware 2.6.7
  • draytek vigorswitch_pq2121x_firmware 2.6.7
  • draytek vigorswitch_p2540xs_firmware 2.6.7
  • draytek vigorswitch_p2280x_firmware 2.6.7
  • draytek vigorswitch_p2100_firmware 2.6.7
  • draytek vigorswitch_q2200x_firmware 2.6.7
  • draytek vigorswitch_q2121x_firmware 2.6.7
  • draytek vigorswitch_g2540xs_firmware 2.6.7
  • draytek vigorswitch_g2280x_firmware 2.6.7
  • draytek vigorswitch_g2121_firmware 2.6.7
  • draytek vigorswitch_g2100_firmware 2.6.7
  • draytek vigorswitch_fx2120_firmware 2.6.7
  • draytek vigorswitch_p1282_firmware 2.6.7
  • draytek vigorswitch_g1282_firmware 2.6.7
  • draytek vigorswitch_g1085_firmware 2.6.7
  • draytek vigorswitch_g1080_firmware 2.6.7
  • draytek vigorap_903_firmware 1.4.0
  • draytek vigorap_912c_firmware 1.4.0
  • draytek vigorap_918r_firmware 1.4.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gist.github.com https://gist.github.com/Ji4n1ng/6d028709d39458f5ab95b3ea211225ef referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-798 Use of Hard-coded Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.