# CVE-2025-44643: DrayTek VigorAP hardcoded weak password in ripd.conf

Source: https://junglewise.ai/threats/cve-2025-44643-draytek-vigorap-hardcoded-weak-password-in-ripd-conf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-04. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-44643 · Severity: high · CVSS 8.6 · Published 2025-08-04

Multiple DrayTek wireless access points contain a security flaw where a weak, hardcoded password is used for the internal routing service. This allows an attacker on the network to take control of how the device directs traffic. An exploit could lead to network outages, the redirection of user data, or unauthorized interception of sensitive communications.

Technologies: [DrayTek VigorAP 903](https://junglewise.ai/threats/technologies/vigorap-903), [DrayTek VigorAP 912C](https://junglewise.ai/threats/technologies/vigorap-912c), [DrayTek VigorAP 918R](https://junglewise.ai/threats/technologies/vigorap-918r). Vendors: [DrayTek](https://junglewise.ai/threats/vendors/draytek).

## Quick answers

**Is CVE-2025-44643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-44643 being exploited in the wild.

**How severe is CVE-2025-44643?** High severity, with a CVSS score of 8.6, published 4 August 2025.

**Which products and versions are affected?** DrayTek VigorAP 903 1.4.18; DrayTek VigorAP 912C 1.4.9; DrayTek VigorAP 918R 1.4.9.

**Is there a fix for CVE-2025-44643?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-44643 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-44643?** Check whether you run DrayTek VigorAP 903, DrayTek VigorAP 912C or DrayTek VigorAP 918R at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the configuration of the Routing Information Protocol (RIP) daemon (ripd) within certain DrayTek VigorAP firmware versions. The 'password' property in the ripd.conf configuration file is set to a hardcoded weak value (CWE-798). An unauthenticated attacker with network access can use this credential to gain unauthorized control over the routing daemon. This allows for the injection of malicious routes, potentially leading to traffic interception (Man-in-the-Middle) or a Denial of Service (DoS) by disrupting network pathing. Affected models include AP903, AP912C, and AP918R.

## Affected products

- DrayTek VigorAP 903 1.4.18
- DrayTek VigorAP 912C 1.4.9
- DrayTek VigorAP 918R 1.4.9

## Timeline

- 2025-08-04: disclosed: Initial NVD publication date
- 2025-08-04: advisory: CISA-ADP enrichment added CVSS and CWE data

## References

- [https://www.notion.so/Misconfiguration-in-Draytek-AP903-23a54a1113e780aca7f2d21dbdab9db8](https://www.notion.so/Misconfiguration-in-Draytek-AP903-23a54a1113e780aca7f2d21dbdab9db8)

## Related threats

- [DrayTek VigorAP command injection in dray_apm](https://junglewise.ai/threats/cve-2026-71914-draytek-vigorap-command-injection-in-dray-apm)
- [DrayTek VigorAP command injection in upload_settings.cgi](https://junglewise.ai/threats/cve-2026-71913-draytek-vigorap-command-injection-in-upload-settings-cgi)
- [DrayTek VigorAP buffer overflow in apautotest](https://junglewise.ai/threats/cve-2026-71912-draytek-vigorap-buffer-overflow-in-apautotest)
- [DrayTek VigorAP buffer overflow in setLan function](https://junglewise.ai/threats/cve-2026-71911-draytek-vigorap-buffer-overflow-in-setlan-function)
- [DrayTek VigorAP OS command injection in apautotest](https://junglewise.ai/threats/cve-2026-71910-draytek-vigorap-os-command-injection-in-apautotest)