CVE-2023-33778

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-01 · updated 2026-06-17
Weakness: CWE-798

Description

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their own account. Attackers are then able to create WCF and DrayDDNS licenses and synchronize them from the website.

Affected products

DrayTek Myvigor: before 2.3.2 — fixed in 2.3.2
DrayTek Vigor1000B Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor130 Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor165 Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor166 Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor167 Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2135Ac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2135Ax Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2135Fvac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2135Vac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2620L Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2620Ln Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2763Ac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2765Ac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2765Ax Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2765Vac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2766Ac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2766Ax Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2766Vac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2832N Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862Ac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862B Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862Bn Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862L Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862Lac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862Ln Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862N Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2862Vac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2865Ac Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4
DrayTek Vigor2865Ax Firmware: before 3.9.6; from 4.0.0 before 4.2.4 — fixed in 3.9.6, 4.2.4

How to fix

Upgrade to a fixed version: DrayTek Myvigor 2.3.2; DrayTek Vigor1000B Firmware 3.9.6, 4.2.4; DrayTek Vigor130 Firmware 3.9.6, 4.2.4; DrayTek Vigor165 Firmware 3.9.6, 4.2.4; DrayTek Vigor166 Firmware 3.9.6, 4.2.4; DrayTek Vigor167 Firmware 3.9.6, 4.2.4; DrayTek Vigor2135Ac Firmware 3.9.6, 4.2.4; DrayTek Vigor2135Ax Firmware 3.9.6, 4.2.4; DrayTek Vigor2135Fvac Firmware 3.9.6, 4.2.4; DrayTek Vigor2135Vac Firmware 3.9.6, 4.2.4; DrayTek Vigor2620L Firmware 3.9.6, 4.2.4; DrayTek Vigor2620Ln Firmware 3.9.6, 4.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-33778 or the next vulnerability affects your stack