What is the CVSS score of CVE-2025-44643?

CVE-2025-44643 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Draytek are affected by CVE-2025-44643?

Organizations using Draytek products are affected by Insecure Configuration. This affects AP903 face significant risk from CVE-2025-44643, a incorrect default permissions vulnerability rated CVSS…

How to fix or mitigate CVE-2025-44643?

Within 30 days: Identify all affected systems running Draytek products are affected by Insecure Configuration. Thi and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Draytek CVE-2025-44643

HIGH

Incorrect Default Permissions (CWE-276)

2025-08-04 cve@mitre.org

Privilege Escalation

8.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:05 vuln.today

CVE Published

Aug 04, 2025 - 15:15 nvd

HIGH 8.6

DescriptionCVE.org

Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.

AnalysisAI

Certain Draytek products are affected by Insecure Configuration. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.