CVE-2023-33778 (myvigor, vigor1000b_firmware, vigor130_firmware, vigor165_firmware, vigor166_firmware, vigor167_firmware, vigor2135ac_firmware, vigor2135ax_firmware, vigor2135fvac_firmware, vigor2135vac_firmware, vigor2620l_firmware, vigor2620ln_firm | allinfosecnews.com

June 1, 2023, 4:15 a.m. |

National Vulnerability Database web.nvd.nist.gov

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

access access points account attackers bind cve device draytek draytek vigor encryption encryption keys firmware hardcoded keys own routers switches

More from web.nvd.nist.gov / National Vulnerability Database

CVE-2023-45955 (lightstrip_firmware) 5 months, 3 weeks ago | web.nvd.nist.gov

attackers cve denial of service issue +1

CVE-2023-40101 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android check collapse cve +7

CVE-2023-21377 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android bypass cve disclosure +8

CVE-2023-21380 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android bluetooth buffer buffer overflow +9

CVE-2023-21382 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

access android check cve +11

CVE-2023-21381 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android arbitrary code code code execution +10

CVE-2023-21385 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android corruption cve disclosure +7

CVE-2023-21387 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android backup bypass cve +11

CVE-2023-21389 (android) 5 months, 4 weeks ago | web.nvd.nist.gov

android bypass check cve +10

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

View on infosec-jobs.com

Network Security Engineer

@ Meta | Menlo Park, CA | Remote, US

View on infosec-jobs.com

Security Engineer, Investigations - i3

@ Meta | Washington, DC

View on infosec-jobs.com

Threat Investigator- Security Analyst

@ Meta | Menlo Park, CA | Seattle, WA | Washington, DC

View on infosec-jobs.com

Security Operations Engineer II

@ Microsoft | Redmond, Washington, United States

View on infosec-jobs.com

Engineering -- Tech Risk -- Global Cyber Defense & Intelligence -- Bug Bounty -- Associate -- Dallas

@ Goldman Sachs | Dallas, Texas, United States

View on infosec-jobs.com