Skip to content
Fencer Intel
critical 10.0

CVE-2022-32548 in the critical feed json

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1.

published 4y ago modified 4mo ago also EUVD-2022-35616

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
34.0%
EPSS 34.0% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

Patch / fix

  • draytek vigor3910_firmware 4.3.1.1
  • draytek vigor1000b_firmware 4.3.1.1
  • draytek vigor2962_firmware 4.3.1.1
  • draytek vigor2962p_firmware 4.3.1.1
  • draytek vigor2927_firmware 4.4.0
  • draytek vigor2927ax_firmware 4.4.0
  • draytek vigor2927ac_firmware 4.4.0
  • draytek vigor2927vac_firmware 4.4.0
  • draytek vigor2927l_firmware 4.4.0
  • draytek vigor2927lac_firmware 4.4.0
  • draytek vigor2915_firmware 4.3.3.2
  • draytek vigor2915ac_firmware 4.3.3.2
  • draytek vigor2952_firmware 3.9.7.2
  • draytek vigor2952p_firmware 3.9.7.2
  • draytek vigor3220_firmware 3.9.7.2
  • draytek vigor2926_firmware 3.9.8.1
  • draytek vigor2926n_firmware 3.9.8.1
  • draytek vigor2926ac_firmware 3.9.8.1
  • draytek vigor2926vac_firmware 3.9.8.1
  • draytek vigor2926l_firmware 3.9.8.1

Is CVE-2022-32548 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

33.99% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • securityweek.com https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers referenced PoC, tagged "exploit" by a source, unverified
  • trellix.com https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.