CVE-2023-23313

CVSS V2 None CVSS V3 None
Description
Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2.
Overview
  • CVE ID
  • CVE-2023-23313
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-03T22:15:09
  • Last Modified Date
  • 2023-03-10T14:52:03
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:draytek:vigor2860_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860n-plus_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860n-plus:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860vn-plus_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860vn-plus:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860ac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860vac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860l_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2860ln_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:vigor2860ln:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2832_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.3
cpe:2.3:h:draytek:vigor2832:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2832n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.3
cpe:2.3:h:draytek:vigor2832n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2766_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2766:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2766ax_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2766ax:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2766ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2766ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2766vac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2766vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2765_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2765:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2765ax_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2765ax:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2765ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2765ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2765va_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2765va:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2763_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.2
cpe:2.3:h:draytek:vigor2763:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2763ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.2
cpe:2.3:h:draytek:vigor2763ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2762_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2762:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2762n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2762n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2762ac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2762ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2762vac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2762vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2135_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2135:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2135ax_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2135ax:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2135ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2135ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2135vac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2135vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2135fvac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:vigor2135fvac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2133_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2133:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2133n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2133n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2133ac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2133ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2133vac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2133vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor2133fvac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.6.5
cpe:2.3:h:draytek:vigor2133fvac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor166_firmware:*:*:*:*:*:*:*:* 1 OR 4.2.4.1
cpe:2.3:h:draytek:vigor166:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor165_firmware:*:*:*:*:*:*:*:* 1 OR 4.2.4.1
cpe:2.3:h:draytek:vigor165:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigor130_firmware:*:*:*:*:*:*:*:* 1 OR 3.8.5.1
cpe:2.3:h:draytek:vigor130:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:vigornic_132_firmware:*:*:*:*:*:*:*:* 1 OR 3.8.5.1
cpe:2.3:h:draytek:vigornic_132:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor3910_firmware:*:*:*:*:*:*:*:* 1 OR 4.3.2.2
cpe:2.3:h:draytek:virgor3910:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor3220_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.7.4
cpe:2.3:h:draytek:virgor3220:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2962_firmware:*:*:*:*:*:*:*:* 1 OR 4.3.2.2
cpe:2.3:h:draytek:virgor2962:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2962p_firmware:*:*:*:*:*:*:*:* 1 OR 4.3.2.2
cpe:2.3:h:draytek:virgor2962p:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor1000b_firmware:*:*:*:*:*:*:*:* 1 OR 4.3.2.2
cpe:2.3:h:draytek:virgor1000b:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2952_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.7.4
cpe:2.3:h:draytek:virgor2952:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2952p_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.7.4
cpe:2.3:h:draytek:virgor2952p:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927ax_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927ax:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927vac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927f_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927f:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927l_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2927lac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.3
cpe:2.3:h:draytek:virgor2927lac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926ac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926vac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926l_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926ln_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926ln:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2926lac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2926lac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925n-plus_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925n-plus:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925vn-plus_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925vn-plus:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925ac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925vac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925fn_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925fn:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925l_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2925ln_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.4
cpe:2.3:h:draytek:virgor2925ln:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2915_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:virgor2915:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2915ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.2.1
cpe:2.3:h:draytek:virgor2915ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2866_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2866:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2866ax_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2866ax:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2866ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2866ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2866vac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2866vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2866l_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2866l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2866lac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2866lac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2865_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2865:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2865ax_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2865ax:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2865ac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2865ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2865vac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2865vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2865l_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2865l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2865lac_firmware:*:*:*:*:*:*:*:* 1 OR 4.4.1.1
cpe:2.3:h:draytek:virgor2865lac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862n_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862n:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862ac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862ac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862vac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862vac:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862b_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862b:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862bn_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862bn:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862l_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862l:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862ln_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862ln:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:draytek:virgor2862lac_firmware:*:*:*:*:*:*:*:* 1 OR 3.9.9.1
cpe:2.3:h:draytek:virgor2862lac:-:*:*:*:*:*:*:* 0 OR
References
Reference URL Reference Tags
https://www.draytek.com/about/security-advisory/cross-site-scripting-vulnerability-(cve-2023-23313)/ Vendor Advisory
https://www.horizonsecurity.it/lang_EN/advisories/?a=22&title=Multiple+XSS+Stored+in+DrayTek+routers+web+interface++CVE202323313 Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-23313
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23313
History
Created Old Value New Value Data Type Notes
2023-04-17 05:55:29 Added to TrackCVE
2023-04-17 05:55:31 Weakness Enumeration new