CVE-2025-44643

HIGH EPSS 15.9%

Published Aug 4, 202511mo ago · Modified Jun 17, 20262w ago

8.6 CVSS 3.1

High

Published Aug 4, 2025 11mo ago

Last Modified Jun 17, 2026 2w ago

Description

Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.

CVSS Details

Base Score

8.6

Exploitability

3.9

Impact

4.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability High

Threat Intelligence

EPSS Exploit Probability

15.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-276

CWE-798 Use of Hard-coded Credentials Authentication

References 2

draytek.com http://draytek.com
notion.so https://www.notion.so/Misconfiguration-in-Draytek-AP903-23a54a1113e780aca7f2d21dbdab9db8

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.