DrayOS Router Flaw Allows Remote Code Execution by Attackers

A critical vulnerability affecting DrayOS routers could let unauthenticated attackers execute code remotely by targeting the Web User Interface (WebUI). The flaw stems from the use of an uninitialized variable in WebUI logic, and crafting special HTTP or HTTPS requests can trigger memory corruption, potentially crashing the device or enabling remote code execution in certain scenarios.

Discovered on 22 July by Pierre-Yves Maes of ChapsVision, the weakness requires no valid credentials and can be exploited by any attacker with network access to the router’s WebUI. The CVE identified for this issue is CVE-2025-10547, with exploitation possible via unauthenticated HTTP/HTTPS requests to the WebUI.

Affected models include the Vigor1000B, Vigor2962, Vigor3910, Vigor3912, Vigor2135, and various models within the Vigor276x, Vigor286x, Vigor291x, Vigor292x, and Vigor295x series, among others; local network access can be sufficient if firmware is outdated. According to DrayTek, firmware updates are available to correct the uninitialized variable usage, and administrators should upgrade affected models at the earliest opportunity.