CVE-2023-33778
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below...
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
- Record
CVE-2023-33778- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
CVE List
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
- Record
CVE-2023-33778- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
EUVDEUVD-2023-37930
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
- Record
EUVD-2023-37930- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-68ff-q375-8phx
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below...
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.
- Record
GHSA-68ff-q375-8phx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
Affected products
- draytek myvigor
- draytek vigor1000b firmware
- draytek vigor130 firmware
- draytek vigor165 firmware
- draytek vigor166 firmware
- draytek vigor167 firmware
- draytek vigor2135ac firmware
- draytek vigor2135ax firmware
- draytek vigor2135fvac firmware
- draytek vigor2135vac firmware
- draytek vigor2620l firmware
- draytek vigor2620ln firmware
Show 60 moreShow less
- draytek vigor2763ac firmware
- draytek vigor2765ac firmware
- draytek vigor2765ax firmware
- draytek vigor2765vac firmware
- draytek vigor2766ac firmware
- draytek vigor2766ax firmware
- draytek vigor2766vac firmware
- draytek vigor2832n firmware
- draytek vigor2862ac firmware
- draytek vigor2862b firmware
- draytek vigor2862bn firmware
- draytek vigor2862l firmware
- draytek vigor2862lac firmware
- draytek vigor2862ln firmware
- draytek vigor2862n firmware
- draytek vigor2862vac firmware
- draytek vigor2865ac firmware
- draytek vigor2865ax firmware
- draytek vigor2865l firmware
- draytek vigor2865lac firmware
- draytek vigor2865vac firmware
- draytek vigor2866ac firmware
- draytek vigor2866ax firmware
- draytek vigor2866l firmware
- draytek vigor2866lac firmware
- draytek vigor2866vac firmware
- draytek vigor2915ac firmware
- draytek vigor2926 plus firmware
- draytek vigor2927ac firmware
- draytek vigor2927ax firmware
- draytek vigor2927f firmware
- draytek vigor2927l firmware
- draytek vigor2927lac firmware
- draytek vigor2927vac firmware
- draytek vigor2962 firmware
- draytek vigor3910 firmware
- draytek vigorap 1000c firmware
- draytek vigorap 1060c firmware
- draytek vigorap 903 firmware
- draytek vigorap 906 firmware
- draytek vigorap 912c firmware
- draytek vigorap 918r firmware
- draytek vigorap 960c firmware
- draytek vigorlte 200n firmware
- draytek vigorswitch fx2120 firmware
- draytek vigorswitch g1080 firmware
- draytek vigorswitch g1085 firmware
- draytek vigorswitch g1282 firmware
- draytek vigorswitch g2100 firmware
- draytek vigorswitch g2121 firmware
- draytek vigorswitch g2280x firmware
- draytek vigorswitch g2540xs firmware
- draytek vigorswitch p1282 firmware
- draytek vigorswitch p2100 firmware
- draytek vigorswitch p2280x firmware
- draytek vigorswitch p2540xs firmware
- draytek vigorswitch pq2121x firmware
- draytek vigorswitch pq2200xb firmware
- draytek vigorswitch q2121x firmware
- draytek vigorswitch q2200x firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33778 is a critical vulnerability (CVSS 9.8) in Draytek Myvigor, published June 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. No source names a fixed version.