Is CVE-2025-44643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-44643 being exploited in the wild.

How severe is CVE-2025-44643?

High severity, with a CVSS score of 8.6, published 4 August 2025.

Which products and versions are affected?

DrayTek VigorAP 903 1.4.18; DrayTek VigorAP 912C 1.4.9; DrayTek VigorAP 918R 1.4.9.

Is there a fix for CVE-2025-44643?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-44643 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-44643?

Check whether you run DrayTek VigorAP 903, DrayTek VigorAP 912C or DrayTek VigorAP 918R at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-44643: DrayTek VigorAP hardcoded weak password in ripd.conf

CVE-2025-44643 · Severity: high · CVSS 8.6 · Published 2025-08-04

Multiple DrayTek wireless access points contain a security flaw where a weak, hardcoded password is used for the internal routing service. This allows an attacker on the network to take control of how the device directs traffic. An exploit could lead to network outages, the redirection of user data, or unauthorized interception of sensitive communications.

Technologies: DrayTek VigorAP 903, DrayTek VigorAP 912C, DrayTek VigorAP 918R. Vendors: DrayTek.

Quick answers

Is CVE-2025-44643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-44643 being exploited in the wild.
How severe is CVE-2025-44643?: High severity, with a CVSS score of 8.6, published 4 August 2025.
Which products and versions are affected?: DrayTek VigorAP 903 1.4.18; DrayTek VigorAP 912C 1.4.9; DrayTek VigorAP 918R 1.4.9.
Is there a fix for CVE-2025-44643?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-44643 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-44643?: Check whether you run DrayTek VigorAP 903, DrayTek VigorAP 912C or DrayTek VigorAP 918R at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the configuration of the Routing Information Protocol (RIP) daemon (ripd) within certain DrayTek VigorAP firmware versions. The 'password' property in the ripd.conf configuration file is set to a hardcoded weak value (CWE-798). An unauthenticated attacker with network access can use this credential to gain unauthorized control over the routing daemon. This allows for the injection of malicious routes, potentially leading to traffic interception (Man-in-the-Middle) or a Denial of Service (DoS) by disrupting network pathing. Affected models include AP903, AP912C, and AP918R.

Affected products

DrayTek VigorAP 903 1.4.18
DrayTek VigorAP 912C 1.4.9
DrayTek VigorAP 918R 1.4.9

Timeline

2025-08-04: disclosed: Initial NVD publication date
2025-08-04: advisory: CISA-ADP enrichment added CVSS and CWE data

References

https://www.notion.so/Misconfiguration-in-Draytek-AP903-23a54a1113e780aca7f2d21dbdab9db8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.