CVE-2022-32548

An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

• CWE-120

• https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routersExploit, Third Party Advisory
• https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.htmlExploit, Third Party Advisory
• https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routersExploit, Third Party Advisory
• https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.htmlExploit, Third Party Advisory

Published

Aug 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32540Information Disclosure in Operator Client application in BVM…5.9
• CVE-2022-32543An integer overflow vulnerability exists in the way ESTsoft …7.8
• CVE-2022-32544Operation restriction bypass vulnerability in Project of Cyb…4.3
• CVE-2022-32545A vulnerability was found in ImageMagick, causing an outside…7.8
• CVE-2022-32546A vulnerability was found in ImageMagick, causing an outside…7.8
• CVE-2022-32547In ImageMagick, there is load of misaligned address for type…7.8
• CVE-2022-32549Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.…5.3
• CVE-2022-3255If an attacker can control a script that is executed in the …4.8
• CVE-2022-32550An issue was discovered in AgileBits 1Password, involving th…4.8
• CVE-2022-32551Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows p…7.5
• CVE-2022-32552Pure Storage FlashArray products running Purity//FA 6.2.0 - …8.8
• CVE-2022-32553Pure Storage FlashArray products running Purity//FA 6.2.0 - …8.8