Unauthenticated RCE Flaw Patched in DrayTek Routers

DrayTek has patched an unauthenticated remote code execution vulnerability affecting DrayOS routers, tracked as CVE-2025-10547, which can be exploited via crafted HTTP or HTTPS requests to a vulnerable device’s web interface. According to DrayTek, successful exploitation may lead to memory corruption and a system crash, with the potential to execute arbitrary code remotely in certain circumstances.

The company notes that routers are shielded from WAN-based attacks if WebUI and SSL VPN remote access is disabled or if ACLs are correctly configured, but an attacker with local network access could still exploit the flaw via the WebUI. DrayTek credited security researcher Pierre-Yves Maes of ChapsVision for reporting the vulnerability on July 22, and it has released firmware updates across 35 Vigor router models, urging users to update promptly.

SecurityWeek reports that DrayTek devices are widely used by prosumers and SMBs and that ransomware groups targeted hundreds of organisations last year by exploiting an unknown DrayTek router flaw, though there is no mention of active exploitation in the wild in the advisory.