{"id":"CVE-2022-32548","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-32548","generatedAt":"2026-11-05T00:02:51.739Z","title":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","description":"An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.","published":"2022-08-29T06:15:09.000Z","lastModified":"2026-06-17T04:47:31.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-120"],"affected":["draytek/vigor3910 firmware","draytek/vigor1000b firmware","draytek/vigor2962 firmware","draytek/vigor2962p firmware","draytek/vigor2927 firmware","draytek/vigor2927ax firmware","draytek/vigor2927ac firmware","draytek/vigor2927vac firmware","draytek/vigor2927l firmware","draytek/vigor2927lac firmware","draytek/vigor2915 firmware","draytek/vigor2915ac firmware","draytek/vigor2952 firmware","draytek/vigor2952p firmware","draytek/vigor3220 firmware","draytek/vigor2926 firmware","draytek/vigor2926n firmware","draytek/vigor2926ac firmware","draytek/vigor2926vac firmware","draytek/vigor2926l firmware","draytek/vigor2926ln firmware","draytek/vigor2926lac firmware","draytek/vigor2862 firmware","draytek/vigor2862n firmware","draytek/vigor2862ac firmware","draytek/vigor2862vac firmware","draytek/vigor2862b firmware","draytek/vigor2862bn firmware","draytek/vigor2862l firmware","draytek/vigor2862ln firmware","draytek/vigor2862lac firmware","draytek/vigor2620l firmware","draytek/vigor2620ln firmware","draytek/vigorlte 200n firmware","draytek/vigor2133 firmware","draytek/vigor2133n firmware","draytek/vigor2133ac firmware","draytek/vigor2133vac firmware","draytek/vigor2133fvac firmware","draytek/vigor2762 firmware","draytek/vigor2762n firmware","draytek/vigor2762ac firmware","draytek/vigor2762vac firmware","draytek/vigor165 firmware","draytek/vigor166 firmware","draytek/vigor2135 firmware","draytek/vigor2135ac firmware","draytek/vigor2135vac firmware","draytek/vigor2135fvac firmware","draytek/vigor2765 firmware","draytek/vigor2765ac firmware","draytek/vigor2765vac firmware","draytek/vigor2766 firmware","draytek/vigor2766ac firmware","draytek/vigor2766vac firmware","draytek/vigor2832 firmware","draytek/vigor2865 firmware","draytek/vigor2865ax firmware","draytek/vigor2865ac firmware","draytek/vigor2865vac firmware"],"epss":{"score":0.33992,"percentile":0.98399,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 34.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-32548","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}