CVE-2025-44643

State: Published
Severity: 8.6 High
Published: Aug 4, 2025
Updated: Jul 5, 2026
Reserved: Apr 22, 2025

Description

Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	CISA-ADP

Weaknesses

CWE-798 Use of Hard-coded Credentials
CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.notion.so/Misconfiguration-in-Draytek-AP903-23a54a1113e780aca7f2d21dbdab9db8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.