Strix
26.1K

CVE-2023-23313

MEDIUMCVSS 6.1/10EPSS 0.36%

Last modified

CVE-2023-23313 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.. EPSS estimates a 0.36% chance of exploitation in the next 30 days.

Description

Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.36%

27.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
DraytekVigor2860 Firmware< 3.9.4
DraytekVigor2860n Firmware< 3.9.4
DraytekVigor2860n-Plus Firmware< 3.9.4
DraytekVigor2860vn-Plus Firmware< 3.9.4
DraytekVigor2860ac Firmware< 3.9.4
DraytekVigor2860vac Firmware< 3.9.4
DraytekVigor2860l Firmware< 3.9.4
DraytekVigor2860ln Firmware< 3.9.4
DraytekVigor2832 Firmware< 3.9.6.3
DraytekVigor2832n Firmware< 3.9.6.3
DraytekVigor2766 Firmware< 4.4.2.1
DraytekVigor2766ax Firmware< 4.4.2.1
DraytekVigor2766ac Firmware< 4.4.2.1
DraytekVigor2766vac Firmware< 4.4.2.1
DraytekVigor2765 Firmware< 4.4.2.1
DraytekVigor2765ax Firmware< 4.4.2.1
DraytekVigor2765ac Firmware< 4.4.2.1
DraytekVigor2765va Firmware< 4.4.2.1
DraytekVigor2763 Firmware< 4.4.2.2
DraytekVigor2763ac Firmware< 4.4.2.2
DraytekVigor2762 Firmware< 3.9.6.5
DraytekVigor2762n Firmware< 3.9.6.5
DraytekVigor2762ac Firmware< 3.9.6.5
DraytekVigor2762vac Firmware< 3.9.6.5
DraytekVigor2135 Firmware< 4.4.2.1
DraytekVigor2135ax Firmware< 4.4.2.1
DraytekVigor2135ac Firmware< 4.4.2.1
DraytekVigor2135vac Firmware< 4.4.2.1
DraytekVigor2135fvac Firmware< 4.4.2.1
DraytekVigor2133 Firmware< 3.9.6.5
DraytekVigor2133n Firmware< 3.9.6.5
DraytekVigor2133ac Firmware< 3.9.6.5
DraytekVigor2133vac Firmware< 3.9.6.5
DraytekVigor2133fvac Firmware< 3.9.6.5
DraytekVigor166 Firmware< 4.2.4.1
DraytekVigor165 Firmware< 4.2.4.1
DraytekVigor130 Firmware< 3.8.5.1
DraytekVigornic 132 Firmware< 3.8.5.1
DraytekVigor3910 Firmware< 4.3.2.2
DraytekVigor3220 Firmware< 3.9.7.4
DraytekVigor2962 Firmware< 4.3.2.2
DraytekVigor2962p Firmware< 4.3.2.2
DraytekVigor1000b Firmware< 4.3.2.2
DraytekVigor2952 Firmware< 3.9.7.4
DraytekVigor2952p Firmware< 3.9.7.4
DraytekVigor2927 Firmware< 4.4.2.3
DraytekVigor2927ax Firmware< 4.4.2.3
DraytekVigor2927ac Firmware< 4.4.2.3
DraytekVigor2927vac Firmware< 4.4.2.3
DraytekVigor2927f Firmware< 4.4.2.3

Showing 50 of 91 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2023-23313?
Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.
How severe is CVE-2023-23313?
CVE-2023-23313 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.36% probability of exploitation in the next 30 days.
How do I fix CVE-2023-23313?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-23313?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST