$ cve CVE-2022-32548 JSON

CVE-2022-32548

10.0

CRITICAL · CVSS 3.1 · EPSS 34% (pctl 98)

Patch early

EPSS 34% — above the 10% action threshold.

Description

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

Scoring

CVSS	10.0 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	33.99% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-120
On CISA KEV	no
Public exploit	none known
Published	2022-08-29
Last modified	2026-06-17

Affected (40)

Vendor	Product
draytek	vigor1000b
draytek	vigor1000b firmware
draytek	vigor2915
draytek	vigor2915 firmware
draytek	vigor2915ac
draytek	vigor2915ac firmware
draytek	vigor2926
draytek	vigor2926 firmware
draytek	vigor2926ac
draytek	vigor2926ac firmware
draytek	vigor2926l
draytek	vigor2926l firmware
draytek	vigor2926n
draytek	vigor2926n firmware
draytek	vigor2926vac
draytek	vigor2926vac firmware
draytek	vigor2927
draytek	vigor2927 firmware
draytek	vigor2927ac
draytek	vigor2927ac firmware
draytek	vigor2927ax
draytek	vigor2927ax firmware
draytek	vigor2927l
draytek	vigor2927l firmware
draytek	vigor2927lac
draytek	vigor2927lac firmware
draytek	vigor2927vac
draytek	vigor2927vac firmware
draytek	vigor2952
draytek	vigor2952 firmware
draytek	vigor2952p
draytek	vigor2952p firmware
draytek	vigor2962
draytek	vigor2962 firmware
draytek	vigor2962p
draytek	vigor2962p firmware
draytek	vigor3220
draytek	vigor3220 firmware
draytek	vigor3910
draytek	vigor3910 firmware

References

→ the Explorer · watch your stack · NVD