Remote Code Execution Vulnerability in DrayTek Vigor Routers
Summary
Hide ▲
Show ▼
DrayTek has disclosed a remote code execution vulnerability in several Vigor router models. The flaw, CVE-2025-10547, allows unauthenticated remote attackers to execute arbitrary code by sending crafted HTTP or HTTPS requests to the Web User Interface (WebUI). Successful exploitation can cause memory corruption and system crashes, potentially leading to remote code execution. The vulnerability affects a wide range of Vigor router models, commonly used in prosumer and SMB environments. DrayTek has released firmware updates to mitigate the risk, and administrators are advised to apply these updates immediately.
Timeline
-
02.10.2025 20:37 1 articles · 6d ago
DrayTek discloses remote code execution vulnerability in Vigor routers
DrayTek has disclosed a remote code execution vulnerability in several Vigor router models. The flaw, CVE-2025-10547, allows unauthenticated remote attackers to execute arbitrary code by sending crafted HTTP or HTTPS requests to the WebUI. The vulnerability affects a wide range of models, commonly used in prosumer and SMB environments. DrayTek has released firmware updates to mitigate the risk, and administrators are advised to apply these updates immediately.
Show sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
Information Snippets
-
The vulnerability, CVE-2025-10547, was reported by ChapsVision security researcher Pierre-Yves Maes on July 22.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
-
The flaw can be triggered by sending crafted HTTP or HTTPS requests to the WebUI.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
-
Successful exploitation may cause memory corruption, system crashes, and potentially remote code execution.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
-
The root cause is an uninitialized stack value that can be exploited to achieve arbitrary free(), leading to remote code execution.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
-
The affected models include Vigor1000B, Vigor2962, Vigor3910/3912, and several other series.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
-
DrayTek recommends updating to specific firmware versions to mitigate the vulnerability.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
-
The vulnerability affects routers commonly used in prosumer and SMB environments.
First reported: 02.10.2025 20:371 source, 1 articleShow sources
- DrayTek warns of remote code execution bug in Vigor routers — www.bleepingcomputer.com — 02.10.2025 20:37
Similar Happenings
High-Severity VMware NSX Vulnerabilities Patched by Broadcom
Broadcom has released security updates to address multiple high-severity vulnerabilities in VMware NSX and vCenter, reported by the U.S. National Security Agency (NSA) and independent security researchers. These flaws, CVE-2025-41250, CVE-2025-41251, and CVE-2025-41252, affect the password recovery mechanism, username enumeration, and SMTP header injection, respectively. They can be exploited by unauthenticated attackers to enumerate valid usernames, potentially leading to brute-force attacks or unauthorized access. VMware NSX is a networking virtualization solution within VMware Cloud Foundation, enabling the deployment of traditional and modern applications in private/hybrid clouds. The vulnerabilities highlight the ongoing risk of state-sponsored and cybercriminal exploitation of VMware products. Additionally, Broadcom disclosed three more security flaws in VMware Aria Operations and VMware Tools (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246). These vulnerabilities could allow attackers to escalate privileges to root, steal credentials, or access guest VMs. The NSA's disclosure suggests potential exploitation interest from nation-state actors.