{"id":"CVE-2022-32548","aliases":["EUVD-2022-35616","GHSA-r59x-897w-8h5j"],"status":"published","title":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910...","description":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.33992,"percentile":0.98408,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-120"],"published":"2022-08-29T05:38:35Z","modified":"2026-06-17T04:47:30Z","exploits":[{"source":"pocgithub","id":"MosaedH/CVE-2022-32548-RCE-POC","title":"MosaedH/CVE-2022-32548-RCE-POC","date":"2023-10-27","url":"https://github.com/MosaedH/CVE-2022-32548-RCE-POC"}],"products":[{"vendor":"draytek","product":"vigor1000b_firmware"},{"vendor":"draytek","product":"vigor165_firmware"},{"vendor":"draytek","product":"vigor166_firmware"},{"vendor":"draytek","product":"vigor2133_firmware"},{"vendor":"draytek","product":"vigor2133ac_firmware"},{"vendor":"draytek","product":"vigor2133fvac_firmware"},{"vendor":"draytek","product":"vigor2133n_firmware"},{"vendor":"draytek","product":"vigor2133vac_firmware"},{"vendor":"draytek","product":"vigor2135_firmware"},{"vendor":"draytek","product":"vigor2135ac_firmware"},{"vendor":"draytek","product":"vigor2135fvac_firmware"},{"vendor":"draytek","product":"vigor2135vac_firmware"},{"vendor":"draytek","product":"vigor2620l_firmware"},{"vendor":"draytek","product":"vigor2620ln_firmware"},{"vendor":"draytek","product":"vigor2762_firmware"},{"vendor":"draytek","product":"vigor2762ac_firmware"},{"vendor":"draytek","product":"vigor2762n_firmware"},{"vendor":"draytek","product":"vigor2762vac_firmware"},{"vendor":"draytek","product":"vigor2765_firmware"},{"vendor":"draytek","product":"vigor2765ac_firmware"},{"vendor":"draytek","product":"vigor2765vac_firmware"},{"vendor":"draytek","product":"vigor2766_firmware"},{"vendor":"draytek","product":"vigor2766ac_firmware"},{"vendor":"draytek","product":"vigor2766vac_firmware"},{"vendor":"draytek","product":"vigor2832_firmware"},{"vendor":"draytek","product":"vigor2862_firmware"},{"vendor":"draytek","product":"vigor2862ac_firmware"},{"vendor":"draytek","product":"vigor2862b_firmware"},{"vendor":"draytek","product":"vigor2862bn_firmware"},{"vendor":"draytek","product":"vigor2862l_firmware"},{"vendor":"draytek","product":"vigor2862lac_firmware"},{"vendor":"draytek","product":"vigor2862ln_firmware"},{"vendor":"draytek","product":"vigor2862n_firmware"},{"vendor":"draytek","product":"vigor2862vac_firmware"},{"vendor":"draytek","product":"vigor2865_firmware"},{"vendor":"draytek","product":"vigor2865ac_firmware"},{"vendor":"draytek","product":"vigor2865ax_firmware"},{"vendor":"draytek","product":"vigor2865l_firmware"},{"vendor":"draytek","product":"vigor2865lac_firmware"},{"vendor":"draytek","product":"vigor2865vac_firmware"},{"vendor":"draytek","product":"vigor2866_firmware"},{"vendor":"draytek","product":"vigor2866ac_firmware"},{"vendor":"draytek","product":"vigor2866ax_firmware"},{"vendor":"draytek","product":"vigor2866l_firmware"},{"vendor":"draytek","product":"vigor2866lac_firmware"},{"vendor":"draytek","product":"vigor2866vac_firmware"},{"vendor":"draytek","product":"vigor2915_firmware"},{"vendor":"draytek","product":"vigor2915ac_firmware"},{"vendor":"draytek","product":"vigor2926_firmware"},{"vendor":"draytek","product":"vigor2926ac_firmware"},{"vendor":"draytek","product":"vigor2926l_firmware"},{"vendor":"draytek","product":"vigor2926lac_firmware"},{"vendor":"draytek","product":"vigor2926ln_firmware"},{"vendor":"draytek","product":"vigor2926n_firmware"},{"vendor":"draytek","product":"vigor2926vac_firmware"},{"vendor":"draytek","product":"vigor2927_firmware"},{"vendor":"draytek","product":"vigor2927ac_firmware"},{"vendor":"draytek","product":"vigor2927ax_firmware"},{"vendor":"draytek","product":"vigor2927l_firmware"},{"vendor":"draytek","product":"vigor2927lac_firmware"},{"vendor":"draytek","product":"vigor2927vac_firmware"},{"vendor":"draytek","product":"vigor2952_firmware"},{"vendor":"draytek","product":"vigor2952p_firmware"},{"vendor":"draytek","product":"vigor2962_firmware"},{"vendor":"draytek","product":"vigor2962p_firmware"},{"vendor":"draytek","product":"vigor3220_firmware"},{"vendor":"draytek","product":"vigor3910_firmware"},{"vendor":"draytek","product":"vigorlte_200n_firmware"}],"references":[{"url":"https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32548"},{"url":"https://github.com/advisories/GHSA-r59x-897w-8h5j"}],"sources":{"cve":[{"id":"CVE-2022-32548","description":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","status":"published","published":"2022-08-29T05:38:35Z","modified":"2024-08-03T07:46:43.481Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-35616","description":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","status":"published","published":"2022-08-29T05:38:35Z","modified":"2024-08-03T07:46:43Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical"}],"updated_at":"2026-11-03T03:25:31.522014Z"}],"ghsa":[{"id":"GHSA-r59x-897w-8h5j","title":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910...","description":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","status":"published","published":"2022-08-29T20:06:55Z","modified":"2023-01-30T05:01:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:46:31.204916Z"}],"nvd":[{"id":"CVE-2022-32548","description":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","status":"published","published":"2022-08-29T06:15:09.423Z","modified":"2026-06-17T04:47:30.777Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:07:25.883929Z"}]}}