CVE-2025-10547: DrayOS Vigor Router RCE Vulnerability

CVE-2025-10547 Overview

CVE-2025-10547 is an uninitialized variable vulnerability in the HTTP Common Gateway Interface (CGI) request arguments processing component of DrayTek Vigor routers running DrayOS. The flaw can lead to memory corruption, allowing a remote unauthenticated attacker to execute arbitrary code on the affected appliance. The vulnerability is network-reachable, requires no privileges, and needs no user interaction.

Critical Impact
Remote attackers can achieve unauthenticated remote code execution on DrayTek Vigor routers by sending crafted HTTP requests to the web management interface, fully compromising the perimeter device.

Affected Products

DrayTek Vigor routers running DrayOS firmware
HTTP CGI request arguments processing component
Web management interface exposed via HTTP/HTTPS

Discovery Timeline

2025-10-03 - CVE-2025-10547 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10547

Vulnerability Analysis

The vulnerability resides in the HTTP CGI handler responsible for parsing request arguments submitted to the DrayOS web management interface. A variable used during request processing is not initialized before use, resulting in references to indeterminate memory contents. An attacker can shape adjacent memory through controlled HTTP input so that the uninitialized variable references attacker-influenced data.

When the uninitialized value is dereferenced or used in control-flow decisions, memory corruption occurs. This corruption can be steered to overwrite function pointers, return addresses, or heap metadata. The end result is arbitrary code execution in the context of the web service, which on embedded router platforms typically runs with elevated privileges.

Root Cause

The root cause is improper initialization of stack or heap-allocated memory prior to use within the CGI argument parser. This class of defect maps to Use of Uninitialized Variable weaknesses. DrayTek's advisory groups CVE-2025-10547 with related uninitialized variable issues in DrayOS HTTP handling.

Attack Vector

Exploitation requires only network access to the router's HTTP or HTTPS management service. The attacker sends a crafted HTTP request containing specifically arranged CGI argument values to influence uninitialized memory contents. No authentication and no user interaction are required. Devices exposing the management interface to the internet face the highest exposure, but lateral attackers on the LAN can also reach the service.

The vulnerability mechanism is described in the DrayTek Security Advisory and the CERT Vulnerability Report #294418. No public proof-of-concept code has been released at the time of writing.

Detection Methods for CVE-2025-10547

Indicators of Compromise

Unexpected reboots, crashes, or watchdog resets of Vigor router devices following inbound HTTP traffic
HTTP requests to CGI endpoints on the management interface from untrusted source IP addresses
New or modified administrator accounts, firewall rules, VPN tunnels, or DNS settings on the router
Outbound connections from the router itself to unknown command-and-control hosts

Detection Strategies

Inspect web server and syslog output from the router for malformed HTTP requests targeting CGI handlers and for repeated process restarts
Use network IDS/IPS signatures to flag anomalous request bodies and oversized or malformed CGI parameters directed at Vigor management interfaces
Correlate edge device telemetry with internal network logs to identify post-exploitation pivoting from the router into the LAN

Monitoring Recommendations

Forward router syslog to a centralized logging platform and alert on crashes, configuration changes, and authentication anomalies
Monitor for any exposure of the Vigor management interface to the internet using external attack surface scans
Track firmware versions across the fleet and alert when devices run versions listed as vulnerable in the DrayTek advisory

How to Mitigate CVE-2025-10547

Immediate Actions Required

Apply the firmware updates published in the DrayTek security advisory to all affected Vigor models without delay
Disable remote (WAN-side) access to the router's HTTP and HTTPS management interfaces until patched
Restrict management access to a defined set of trusted internal IP addresses using access control lists
Audit router configurations for unauthorized accounts, port forwards, VPN profiles, and DNS overrides

Patch Information

DrayTek has released firmware updates addressing the uninitialized variable vulnerabilities affecting DrayOS. Refer to the DrayTek Security Advisory for the list of affected models and the corresponding fixed firmware versions. Operators should validate firmware integrity after update and reboot the device.

Workarounds

Block inbound TCP traffic to the router's management ports from untrusted networks at an upstream firewall
Disable the SSL VPN and remote management features on DrayOS if they are not required
Place management interfaces behind a VPN that requires strong authentication before exposing administrative services
Reset administrator credentials and rotate any pre-shared keys or certificates after patching, in case of prior compromise

bash

# Example: restrict Vigor management access to a trusted admin subnet
# (apply via DrayOS firewall rules / ACL configuration)
firewall set rule "Allow-Mgmt" src 10.10.0.0/24 dst <router-wan-ip> dport 443 action accept
firewall set rule "Deny-Mgmt-All" src any dst <router-wan-ip> dport 443 action drop
service set httpd remote-access disable
service set httpsd remote-access enable bind 10.10.0.0/24