CVE-2025-44643: High severity DrayTek AP903 vulnerability
Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
For affected Draytek products, update the 'password' setting in ripd.conf to a strong, non-weak password to avoid the hardcoded weak password risk (AP903 v1.4.18, AP912C v1.4.9, AP918R v1.4.9).
ripd.conf password property = Use a strong password instead of the hardcoded weak password
Event History
Frequently Asked Questions
What is the severity of CVE-2025-44643?
CVE-2025-44643 is classified as a high severity vulnerability due to the presence of a hardcoded weak password affecting sensitive configurations.
How do I fix CVE-2025-44643?
To fix CVE-2025-44643, update your Draytek products to the latest firmware version that addresses the insecure permissions issue.
Which Draytek products are affected by CVE-2025-44643?
CVE-2025-44643 affects the Draytek AP903, AP912C, and AP918R models specifically in certain firmware versions.
What risk does CVE-2025-44643 pose to users?
CVE-2025-44643 poses a risk of unauthorized access and potential takeover of network configurations due to the insecure permissions.
Is there a workaround for CVE-2025-44643 if I cannot update immediately?
A temporary workaround for CVE-2025-44643 is to manually secure the configuration files and change any default passwords as an interim measure.