Buffer overflow in DrayTek Corp. products - CVE-2022-32548

Vulnerability identifier: #VU66126

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32548

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target device.

The vulnerability exists due to a boundary error in the login page at "/cgi-bin/wlogin.cgi" script within the web management interface. A remote attacker can send a specially crafted base64-encoded payload via HTTP POST request to the affected script, trigger memory corruption and execute arbitrary code on the device.

VigorNIC 132
Vigor 130
Vigor 2133
Vigor 2762
Vigor 2952
Vigor 3220
Vigor 2926
Vigor 2862
Vigor 2832
Vigor 2952P
Vigor 2620
Vigor 200n
Vigor 166
Vigor 165
Vigor 1000B
Vigor 2962
Vigor 3910
Vigor 2915
Vigor 2927
Vigor 2865
Vigor 2866
Vigor 2135
Vigor 2765
Vigor 2766
Vigor 167

Install updates from vendor's website. As a temporary solution disable access to the web management interface.

VigorNIC 132 - update to 3.8.5
Vigor 130 - update to 3.8.5
Vigor 2832 - update to 3.9.6
Vigor 2133 - update to 3.9.6.4
Vigor 2762 - update to 3.9.6.4
Vigor 2952 - update to 3.9.7.2
Vigor 2952P - update to 3.9.7.2
Vigor 3220 - update to 3.9.7.2
Vigor 2926 - update to 3.9.8.1
Vigor 2862 - update to 3.9.8.1
Vigor 2620 - update to 3.9.8.1
Vigor 200n - update to 3.9.8.1
Vigor 166 - update to 4.2.4
Vigor 165 - update to 4.2.4
Vigor 1000B - update to 4.3.1.1
Vigor 2962 - update to 4.3.1.1
Vigor 3910 - update to 4.3.1.1
Vigor 2915 - update to 4.3.3.2
Vigor 2927 - update to 4.4.0
Vigor 2865 - update to 4.4.0
Vigor 2866 - update to 4.4.0
Vigor 2135 - update to 4.4.2
Vigor 2765 - update to 4.4.2
Vigor 2766 - update to 4.4.2
Vigor 167 - update to 5.1.1

• https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html

• Remote code execution in DrayTek Vigor routers