Skip to content

Critical RCE in DrayTek Routers (CVE-2022-32548)

We would like to bring your attention to the following critical remote code execution vulnerability we have recently become aware of which affects the following DrayTek products:

  • Vigor3910 < 4.3.1.1

  • Vigor1000B < 4.3.1.1

  • Vigor2962 Series < 4.3.1.1

  • Vigor2927 Series < 4.4.0

  • Vigor2927 LTE Series < 4.4.0

  • Vigor2915 Series < 4.3.3.2

  • Vigor2952 / 2952P < 3.9.7.2

  • Vigor3220 Series < 3.9.7.2

  • Vigor2926 Series < 3.9.8.1

  • Vigor2926 LTE Series < 3.9.8.1

  • Vigor2862 Series < 3.9.8.1

  • Vigor2862 LTE Series < 3.9.8.1

  • Vigor2620 LTE Series < 3.9.8.1

  • VigorLTE 200n < 3.9.8.1

  • Vigor2133 Series < 3.9.6.4

  • Vigor2762 Series < 3.9.6.4

  • Vigor167 < 5.1.1

  • Vigor130 < 3.8.5

  • VigorNIC 132 < 3.8.5

  • Vigor165 < 4.2.4

  • Vigor166 < 4.2.4

  • Vigor2135 Series < 4.4.2

  • Vigor2765 Series < 4.4.2

  • Vigor2766 Series < 4.4.2

  • Vigor2832 < 3.9.6

  • Vigor2865 Series < 4.4.0

  • Vigor2865 LTE Series < 4.4.0

  • Vigor2866 Series < 4.4.0

  • Vigor2866 LTE Series < 4.4.0

The vulnerability allows remote unauthenticated attackers to execute commands on the affected routers via a buffer overflow flaw in the web management interface. This attack can result in a takeover of the operating system on the device which can then lead to a compromise of any internal infrastructure this router is connected to.

Although there are currently no known exploits available publicly, DrayTek are recommending applying the latest firmware patch to secure against potential threats related to this issue.

We are monitoring the situation, please reach out if you have any concerns or queries about this announcement.

References:

https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html

https://thehackernews.com/2022/08/critical-rce-bug-could-let-hackers.html

Jayson E Street joins CovertSwarm

Jayson E Street Joins CovertSwarm

The man who accidentally robbed the wrong bank in Beirut is now part of the Swarm. Jayson E Street joins as Swarm Fellow to help us…
iNTERCEPT - See the invisible

iNTERCEPT – How A Small RF Experiment Turned Into A Community SIGINT Platform

I’ve always been fascinated by RF. There’s something about the fact that it’s invisible, the fact that you might be able to hear aircraft passing overhead…
Silhouette of person in dark environment representing insider threat in agentic IDE security with code and terminal windows in background

When Your IDE Becomes An Insider: Testing Agentic Dev Tools Against Indirect Prompt Injection

Agentic development tools don’t need to bypass your firewall. They’re already inside. And if an attacker can control what they read, they can control what they…