Details of VAR-201805-1238

ID

VAR-201805-1238

TITLE

DrayTek router has 0day vulnerability

Trust: 0.6

sources: CNVD: CNVD-2018-15245

DESCRIPTION

DrayTek is a Taiwanese broadband CPE (client device) manufacturer that manufactures devices including routers, switches, firewalls and VPN devices. There is a 0day vulnerability in the DrayTek router. An attacker can exploit the vulnerability to modify the DNS configuration and then redirect the user to the phishing website through a man-in-the-middle attack to steal data.

Trust: 0.6

sources: CNVD: CNVD-2018-15245

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-15245

AFFECTED PRODUCTS

vendor:	draytek	model:	vigor series	scope:	eq	version:	32003.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	28603.8.8	Trust: 0.6
vendor:	draytek	model:	vigor 2830db	scope:	eq	version:	3.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor 2830sb	scope:	eq	version:	3.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	29263.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	29253.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	29203.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	28623.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigorbx	scope:	eq	version:	20003.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor	scope:	eq	version:	32203.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor	scope:	eq	version:	29523.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	28323.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	27623.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	27603.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor series	scope:	eq	version:	28503.8.8.2	Trust: 0.6
vendor:	draytek	model:	vigor 2830nv2	scope:	eq	version:	3.8.8.2	Trust: 0.6

sources: CNVD: CNVD-2018-15245

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2018-15245
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2018-15245
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2018-15245

PATCH

title:

DrayTek router has a patch for 0day vulnerability

url:

https://www.cnvd.org.cn/patchinfo/show/137297

Trust: 0.6

sources: CNVD: CNVD-2018-15245

EXTERNAL IDS

db:

CNVD

id:

CNVD-2018-15245

Trust: 0.6

sources: CNVD: CNVD-2018-15245

REFERENCES

url:

https://www.draytek.co.uk/support/security-advisories/kb-advisory-csrf-and-dns-dhcp-web-attacks

Trust: 0.6

sources: CNVD: CNVD-2018-15245

SOURCES

db:

CNVD

id:

CNVD-2018-15245

LAST UPDATE DATE

2022-05-04T09:22:51.597000+00:00

SOURCES UPDATE DATE

db:

CNVD

id:

CNVD-2018-15245

date:

2018-08-14T00:00:00

SOURCES RELEASE DATE

db:

CNVD

id:

CNVD-2018-15245

date:

2018-05-28T00:00:00