CVE-2023-23313 Cross-site scripting in n/a

Medium 6.1 Published 3 Mar 2023 Updated 7 Mar 2025

Attackers can inject malicious scripts into Draytek router web interfaces, potentially compromising user sessions and data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-23313?

CVE-2023-23313 is a medium-severity cross-site scripting vulnerability in Draytek Vigor3910 Firmware, published on 3 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.

Weakness: CWE-79

Which versions are affected by CVE-2023-23313?

It affects 91 products.

Products include Draytek Vigor1000b Firmware, Draytek Vigor130 Firmware, Draytek Vigor165 Firmware, Draytek Vigor166 Firmware, Draytek Vigor2133 Firmware, Draytek Vigor2133ac Firmware and 85 more.

How do I fix CVE-2023-23313?

No fix has been published for CVE-2023-23313 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-23313 being exploited?

There is no known exploitation of CVE-2023-23313 in the wild and no public exploit code.

All Draytek Vigor3910 Firmware vulnerabilities

Sources

Also known as GHSA-86xh-6qhg-p6c2.