DrayTek Patches Critical RCE Vulnerability in Routers

What's Happening?

DrayTek has released patches for a critical unauthenticated remote code execution (RCE) vulnerability affecting its DrayOS routers. The flaw, identified as CVE-2025-10547, can be exploited through crafted HTTP or HTTPS requests to a device's web user interface, potentially leading to memory corruption and system crashes. In some cases, it could allow remote execution of arbitrary code. The vulnerability can be mitigated by disabling remote access to the WebUI and SSL VPN services or configuring Access Control Lists (ACLs). DrayTek has issued firmware updates for 35 Vigor router models and urges users to update their devices promptly.

Why It's Important?

The patching of this vulnerability is crucial for maintaining the security of DrayTek routers, which are widely used by prosumers and small to medium-sized businesses. The routers have been popular targets for hackers, and the exploitation of such vulnerabilities can lead to significant security breaches, including ransomware attacks. By addressing this flaw, DrayTek helps protect its users from potential cyber threats and reinforces the importance of regular security updates. Organizations using these routers must prioritize updating their firmware to safeguard their networks and data.

What's Next?

DrayTek's prompt response to the vulnerability highlights the ongoing need for vigilance in cybersecurity. Users are encouraged to apply the firmware updates immediately to prevent exploitation. The company may continue to monitor its products for vulnerabilities and work with security researchers to identify and address potential threats. As cyber threats evolve, router manufacturers like DrayTek must remain proactive in securing their devices and educating users on best practices for network security.

Beyond the Headlines

The incident underscores the broader issue of cybersecurity in IoT devices, which are increasingly targeted by hackers due to their widespread use and often inadequate security measures. As IoT adoption grows, manufacturers must prioritize security in their product design and development processes. The collaboration between DrayTek and security researchers exemplifies the importance of industry partnerships in identifying and mitigating vulnerabilities. This approach can serve as a model for other companies in the tech industry.