CVE-2023-33778 Hardcoded credentials in n/a
Attackers can bind Draytek devices to their accounts using hardcoded keys, enabling unauthorized license creation and synchronization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33778?
CVE-2023-33778 is a critical vulnerability in Draytek Vigor3910 Firmware, published on 1 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
Weakness: CWE-798
Which versions are affected by CVE-2023-33778?
It affects 72 products.
Products include Draytek Myvigor, Draytek Vigor1000b Firmware, Draytek Vigor130 Firmware, Draytek Vigor165 Firmware, Draytek Vigor166 Firmware, Draytek Vigor167 Firmware and 66 more.
How do I fix CVE-2023-33778?
No fix has been published for CVE-2023-33778 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33778 exists.
Sources
Also known as GHSA-68ff-q375-8phx.