Critical · published June 1, 2023
🔥 Hold onto your routers, because hardcoded encryption keys are allowing attackers to hijack devices like it's a video game cheat code! 🚨 This vulnerability is like a hotel giving out the same room key to all guests, allowing anyone to enter any room at will. Without unique keys, your personal space is completely up for grabs. An attacker can bind their own account to any vulnerable Draytek device, gaining full control to create WCF and DrayDDNS licenses. This means they can manipulate your network settings and data without breaking a sweat, leaving your home or business wide open to exploitation!
This vulnerability is like a hotel giving out the same room key to all guests, allowing anyone to enter any room at will. Without unique keys, your personal space is completely up for grabs. CVE-2023-33778 reveals that Draytek devices with firmware versions below certain thresholds rely on hardcoded encryption keys, permitting unauthorized users to gain access and control over the affected devices.
An attacker can bind their own account to any vulnerable Draytek device, gaining full control to create WCF and DrayDDNS licenses. This means they can manipulate your network settings and data without breaking a sweat, leaving your home or business wide open to exploitation! Immediately upgrade your Draytek Vigor Routers to firmware version 3.9.6 or later, Access Points to 1.4.0 or later, Switches to 2.6.7 or later, and Myvigor devices to 2.3.2 or later. It’s crucial to change any default credentials and review your account settings afterwards! You've got this! Secure your devices now, and you'll be a security hero in no time! 🦸♂️