DrayTek Issues Critical Patch for Router RCE Flaw (CVE-2025-10547)

Daily Security Review

Content provided by Daily Security Review. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Daily Security Review or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

7d ago 25:30

MP3•Episode home

A serious unauthenticated remote code execution (RCE) flaw, identified as CVE-2025-10547, has been uncovered in DrayTek’s DrayOS routers. This vulnerability allows attackers to send crafted HTTP or HTTPS requests to the router’s web management interface, potentially leading to memory corruption, system crashes, or full device takeover.

The flaw affects 35 models of DrayTek’s Vigor routers, devices widely deployed by small-to-medium businesses (SMBs) and home professionals. While disabling remote access and using properly configured Access Control Lists (ACLs) can protect against WAN-based attacks, the issue remains exploitable from within local networks—a serious risk for any organization lacking strong internal segmentation.

Discovered by Pierre-Yves Maes of ChapsVision, the vulnerability highlights how edge devices continue to be high-value targets for cybercriminals. DrayTek has released firmware updates to fix the flaw and urges users to apply patches immediately. Experts warn that historical targeting of DrayTek routers by ransomware operators could make this vulnerability a prime candidate for future weaponization if left unpatched.

The key takeaway: update now, tighten access controls, and review network segmentation policies to keep your infrastructure safe.

#DrayTek #CVE202510547 #cybersecurity #RCE #networksecurity #infosec #routervulnerability #DrayOS #patchmanagement #SMBsecurity #firmwareupdate

376 episodes

#Tech #News #Tech News #Daily Security Review