What is CVE-2022-32548?

A critical vulnerability, CVE-2022-32548, has been discovered in certain DrayTek Vigor routers, affecting many small and medium-sized businesses. This security flaw allows remote, unauthenticated attackers to execute arbitrary code and take complete control of vulnerable devices, potentially leading to unauthorized access to internal resources and network breaches. The vulnerability has been rated as critical by both NIST and MITRE, emphasizing the importance of addressing this issue. DrayTek has released firmware updates to patch the vulnerability, and users are urged to update their routers to protect their systems.

Who is impacted by this?

The CVE-2022-32548 vulnerability affects users of certain DrayTek Vigor routers, particularly small and medium-sized businesses. A wide range of firmware versions across nearly 30 router models are impacted, including Vigor3910, Vigor1000B, Vigor2962, Vigor2927, Vigor2915, Vigor2952, Vigor3220, Vigor2926, Vigor2862, Vigor2620L, VigorLTE 200N, Vigor2133, Vigor2762, Vigor2766, Vigor2832, Vigor2865, and Vigor2866. This critical security flaw can lead to unauthorized access to internal resources and network breaches if left unaddressed.

What to do if CVE-2022-32548 affected you

If you're affected by the CVE-2022-32548 vulnerability, it's crucial to take immediate action to protect your network. Follow these simple steps:

1. Check if your DrayTek router model is vulnerable.

2. Visit the manufacturer's website to download and install the patched firmware.

3. Change the password of affected devices and revoke any leaked secrets.

4. Monitor network traffic and internal resources for signs of unauthorized access.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-32548 vulnerability in DrayTek Vigor routers is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical security flaw allows remote attackers to execute arbitrary code and take control of vulnerable devices, potentially leading to unauthorized access to internal resources and network breaches. To address this issue, users should update their routers to the patched firmware provided by the manufacturer.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-120, which involves a buffer overflow issue in certain DrayTek Vigor routers.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the National Vulnerability Database page or the sources listed below.

• SMBs Exposed to Attacks by Critical Vulnerability in DrayTek Vigor Routers - SecurityWeek

• Unauthenticated Remote Code Execution in a Wide Range of DrayTek Vigor Routers - Trellix