Loading story…
DrayTek has issued a security advisory regarding a critical vulnerability, tracked as CVE-2025-10547, affecting multiple models of its Vigor routers. The flaw allows remote, unauthenticated attackers to execute arbitrary code by sending specially crafted HTTP or HTTPS requests to the device's Web User Interface (WebUI). Security researcher Pierre-Yves Maes from ChapsVision discovered and reported the vulnerability to DrayTek on July 22, 2025. The vulnerability is caused by an uninitialized stack value, which can be exploited to trigger the free() function on arbitrary memory locations, a technique known as arbitrary free(), ultimately enabling remote code execution (RCE). Successful exploitation may result in memory corruption and system crashes, with the potential for attackers to gain full control of affected devices. DrayTek's advisory emphasizes that while remote WebUI or SSL VPN access can be disabled or restricted using ACLs and VLANs to reduce WAN exposure, the WebUI remains accessible from the LAN side, leaving devices vulnerable to local threats. The affected routers include both older and flagship models widely used in small to medium businesses, prosumer networks, telecom, and direct link service environments. DrayTek has not observed any evidence of active exploitation in the wild as of the time of the advisory. The company strongly urges administrators to apply the recommended firmware updates to mitigate the risk. Specific firmware versions have been released for each impacted model, such as version 4.4.3.6 or later for Vigor1000B, Vigor2962, and Vigor3910/3912, and version 4.5.1 or later for Vigor2135, Vigor2763/2765/2766, and Vigor2865/2866 Series. Other models, including Vigor2915, Vigor2862/2926, Vigor2952/2952P, Vigor3220, Vigor2860/2925, Vigor2133/2762/2832, Vigor2620, and VigorLTE 200n, also have designated firmware updates to address the vulnerability. DrayTek recommends that organizations limit WAN exposure by disabling remote management interfaces or tightly controlling access. The vulnerability highlights the ongoing risks associated with exposing network device management interfaces to the internet. Administrators are advised to review their device configurations and ensure that only trusted users have access to the WebUI, especially from internal networks. The incident underscores the importance of timely patch management and network segmentation to reduce the attack surface. DrayTek's response demonstrates a proactive approach to vulnerability disclosure and mitigation, providing clear guidance and updates to its user base. Organizations using affected DrayTek Vigor routers should prioritize applying the security updates and reviewing their remote access policies to prevent potential exploitation. The case also serves as a reminder for all network device vendors and users to regularly audit and secure management interfaces against emerging threats.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage emphasized that successful exploitation of CVE-2025-10547 could give unauthenticated attackers root-level access and full compromise of affected DrayTek Vigor devices. This reinforced the severity of the issue for exposed routers.
CVE-2025-10547 was publicly published as a high-severity issue affecting DrayTek Vigor routers running DrayOS, with a CVSS 3.1 score of 8.8. The advisory described an uninitialized-variable bug in HTTP CGI request argument processing that can enable unauthenticated remote code execution.
DrayTek warned that the vulnerability affects multiple Vigor router lines and advised customers to reduce WAN exposure by disabling remote WebUI or SSL VPN access or restricting access with ACLs and VLANs. The company also urged administrators to apply available firmware updates and said there was no evidence of active exploitation at the time.
ChapsVision researcher Pierre-Yves Maes disclosed a vulnerability later tracked as CVE-2025-10547 affecting multiple DrayTek Vigor routers. The flaw involves crafted HTTP/HTTPS requests to the WebUI that can trigger memory corruption, crashes, and possible remote code execution by unauthenticated attackers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link has released security updates to address four critical vulnerabilities affecting its Omada gateway devices, with two of these flaws enabling remote code execution. The most severe of these vulnerabilities, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote unauthenticated attackers to execute arbitrary commands on the device's underlying operating system. Another critical flaw, CVE-2025-6541, is an operating system command injection vulnerability that can be exploited by attackers with access to the web management interface. CVE-2025-7850, also with a CVSS score of 9.3, requires possession of an administrator password to exploit, but similarly allows arbitrary command execution. The fourth vulnerability, CVE-2025-7851, involves improper privilege management and could enable attackers to obtain a root shell under certain conditions. Affected models include ER8411, ER7412-M2, ER707-M2, ER7206, ER605, ER706W, ER706W-4G, ER7212PC, G36, G611, FR365, FR205, and FR307-M2, with specific firmware versions listed as vulnerable. TP-Link has advised all users of impacted devices to immediately update to the latest firmware versions to mitigate these risks. The company also recommends verifying device configurations after upgrading the firmware to ensure security settings remain intact. There is currently no evidence that these vulnerabilities have been exploited in the wild, but the critical nature of the flaws and the potential for remote, unauthenticated exploitation make prompt patching essential. The vulnerabilities could allow attackers to gain full control over affected devices, potentially enabling lateral movement within networks or use of the devices as a foothold for further attacks. The flaws were disclosed in a coordinated manner, and TP-Link responded by releasing patches and advisories to inform customers. Security researchers have highlighted the risk posed by these vulnerabilities, especially in environments where Omada gateways are used to manage network traffic and security. Organizations using these devices should prioritize patching and review their network segmentation to limit potential exposure. The vulnerabilities underscore the importance of regular firmware updates and strong administrative credential management for network infrastructure devices. TP-Link's advisory provides detailed instructions for identifying affected models and applying the necessary updates. The disclosure has prompted renewed attention to the security of network gateways and the need for ongoing vigilance in monitoring for new vulnerabilities. Security teams are urged to monitor for signs of compromise and to ensure that all network devices are included in vulnerability management programs. The incident serves as a reminder of the critical role that timely patching plays in defending against remote exploitation threats.
Jul 12, 2026
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-52906 with a CVSS score of 9.3, has been discovered in TOTOLINK X6000R routers. This flaw allows attackers to execute arbitrary commands on affected devices without authentication, posing a severe risk to users of these widely deployed consumer networking products. The vulnerability is present in firmware version V9.4.0cu.1360_B20241207, which was released on March 28, 2025. In addition to CVE-2025-52906, two other significant vulnerabilities were identified in the same firmware: CVE-2025-52905, an argument injection flaw that can trigger denial-of-service (DoS) conditions, and CVE-2025-52907, a security bypass that could lead to persistent DoS or arbitrary file writes, with the potential for chained attacks resulting in RCE. The unauthenticated command injection vulnerability (CVE-2025-52906) is considered the most critical, as it enables attackers to compromise the device remotely and potentially use it as a foothold for further attacks on connected networks. Palo Alto Networks' Unit 42 team conducted a technical analysis of these vulnerabilities, detailing their root causes and demonstrating their impacts. The widespread use of TOTOLINK routers in consumer and small business environments amplifies the potential impact of these flaws. TOTOLINK has responded by releasing updated firmware to address the vulnerabilities, and users are strongly advised to apply these updates immediately to mitigate risk. Security solutions such as Palo Alto Networks' Next-Generation Firewall and Device Security offerings can help detect and block exploitation attempts. The vulnerabilities highlight the ongoing risks associated with IoT and consumer networking devices, which are often targeted due to their broad deployment and sometimes limited security controls. Attackers exploiting CVE-2025-52906 could gain full control over the router, intercept network traffic, or launch further attacks against internal or external targets. The technical details provided by researchers enable defenders to better understand the attack vectors and implement appropriate mitigations. Organizations and individuals using TOTOLINK X6000R routers should assess their exposure and ensure that all devices are updated to the latest firmware version. The incident underscores the importance of timely vulnerability disclosure and coordinated response between vendors and security researchers. Monitoring for signs of compromise and unusual network activity is recommended for all potentially affected environments. The discovery of these vulnerabilities serves as a reminder of the critical need for robust security practices in the management of network infrastructure devices.
Jun 29, 2026
A critical security vulnerability, tracked as CVE-2025-9242, was discovered in WatchGuard Fireware OS, which powers WatchGuard’s Firebox network security appliances. This flaw is an out-of-bounds write vulnerability in the iked process, specifically within the function 'ike2_ProcessPayload_CERT' in the file 'src/ike/iked/v2/ike2_payload_cert.c'. The vulnerability arises due to a missing length check on the identification buffer, allowing a remote, unauthenticated attacker to trigger a stack-based buffer overflow. Exploitation of this flaw enables arbitrary code execution during the IKE_SA_AUTH phase of the IKEv2 handshake, which is used to establish VPN tunnels. The vulnerability affects both mobile user VPNs and branch office VPNs configured with dynamic gateway peers, making it a significant risk for organizations relying on these features. Fireware OS versions 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3, and 2025.1 are impacted, with fixes released in 2025.1.1, 12.11.4, 12.3.1_Update3 (FIPS-certified), and 12.5.13 for specific models. The 11.x branch has reached end-of-life and is no longer supported. Security researchers, including McCaulay Hudson of watchTowr Labs, highlighted that the vulnerability is particularly attractive to ransomware groups due to its remote, unauthenticated nature and the fact that it targets internet-exposed perimeter appliances. WatchGuard’s Fireware OS is widely deployed, protecting over 250,000 small and midsize enterprises and more than 10 million endpoints globally, amplifying the potential impact of this vulnerability. The flaw was disclosed and patched following responsible disclosure, with WatchGuard issuing an advisory and urging customers to update affected devices immediately. The vulnerability underscores the ongoing risk posed by classic buffer overflow issues, even in modern enterprise-grade security appliances. Researchers were able to reproduce the exploit, demonstrating the ease with which attackers could compromise vulnerable systems. The lack of mainstream exploit mitigations in the affected code path further increases the risk of successful exploitation. Organizations using WatchGuard Fireware OS are advised to review their VPN configurations, apply the latest patches, and consider additional monitoring for signs of exploitation. The incident highlights the importance of timely patch management and the persistent threat posed by memory safety vulnerabilities in critical infrastructure.
Jun 29, 2026