{
    "vuid": "VU#294418",
    "idnumber": "294418",
    "name": "Vigor routers running DrayOS are vulnerable to RCE via EasyVPN and LAN web administration interface",
    "keywords": null,
    "overview": "### Overview\r\nA remote code execution (RCE) vulnerability, tracked as CVE-2025-10547, was discovered through the EasyVPN and LAN web administration interface of Vigor routers by Draytek. A script in the LAN web administration interface uses an unitialized variable, allowing an attacker to send specially crafted HTTP requests that cause memory corruption and potentially allow arbitrary code execution.\r\n\t\r\n### Description\r\nVigor routers are business-grade routers, designed for small to medium-sized businesses, made by Draytek. These routers provide routing, firewall, VPN, content-filtering, bandwidth management, LAN (local area network), and multi-WAN (wide area network) features. Draytek utilizes a proprietary firmware, DrayOS, on the Vigor router line. DrayOS features the EasyVPN and LAN Web Administrator tool s to facilitate LAN and VPN setup. According to the DrayTek [website](https://www.draytek.com/support/knowledge-base/12023), \"with EasyVPN, users no longer need to generate WireGuard keys, import OpenVPN configuration files, or upload certificates. Instead, VPN can be successfully established by simply entering the username and password or getting the OTP code by email.\" \r\n\r\nThe LAN Web Administrator provides a browser-based user interface for router management. When a user interacts with the LAN Web Administration interface, the user interface elements trigger actions that generate HTTP requests to interact with the local server. This process contains an uninitialized variable. Due to the uninitialized variable, an unauthenticated attacker could perform memory corruption on the router via specially crafted HTTP requests to hijack execution or inject malicious payloads. If EasyVPN is enabled, the flaw could be remotely exploited through the VPN interface.\r\n\r\n### Impact\r\nA remote, unathenticated attacker can exploit this vulnerability through accessing the LAN interface\u2014or potentially the WAN interface\u2014if EasyVPN is enabled or remote administration over the internet is activated. If a remote, unauthenticated attacker leverages this vulnerability, they can execute arbitrary code on the router (RCE) and gain full control of the device. A successful attack could result in a attacker gaining root access to a Vigor router to then install backdoors, reconfigure network settings, or block traffic. An attacker may also pivot for lateral movement via intercepting internal communications and bypassing VPNs. \r\n\r\n### Solution\r\nThe DrayTek Security team has developed a series of patches to remediate the vulnerability, and all users of Vigor routers should upgrade to the latest version ASAP. The patches can be found on the [resources](https://www.draytek.com/support/resources?type=version) page of the DrayTek webpage, and the security advisory can be found within the [about](https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/) section of the DrayTek webpage. Consult either the CVE [listing](https://nvd.nist.gov/vuln/detail/CVE-2025-10547) or the [advisory page](https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/) for a full list of affected products. \r\n\r\n### Acknowledgements\r\nThanks to the reporter, Pierre-Yves MAES of ChapsVision (pymaes@chapsvision.com). This document was written by Ayushi Kriplani.",
    "clean_desc": null,
    "impact": null,
    "resolution": null,
    "workarounds": null,
    "sysaffected": null,
    "thanks": null,
    "author": null,
    "public": [
        "https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/",
        "https://www.draytek.com/support/resources?type=version"
    ],
    "cveids": [
        "CVE-2025-10547"
    ],
    "certadvisory": null,
    "uscerttechnicalalert": null,
    "datecreated": "2025-10-03T11:35:31.224065Z",
    "publicdate": "2025-10-03T11:35:31.026053Z",
    "datefirstpublished": "2025-10-03T11:35:31.247121Z",
    "dateupdated": "2025-10-03T11:40:09.876722Z",
    "revision": 2,
    "vrda_d1_directreport": null,
    "vrda_d1_population": null,
    "vrda_d1_impact": null,
    "cam_widelyknown": null,
    "cam_exploitation": null,
    "cam_internetinfrastructure": null,
    "cam_population": null,
    "cam_impact": null,
    "cam_easeofexploitation": null,
    "cam_attackeraccessrequired": null,
    "cam_scorecurrent": null,
    "cam_scorecurrentwidelyknown": null,
    "cam_scorecurrentwidelyknownexploited": null,
    "ipprotocol": null,
    "cvss_accessvector": null,
    "cvss_accesscomplexity": null,
    "cvss_authentication": null,
    "cvss_confidentialityimpact": null,
    "cvss_integrityimpact": null,
    "cvss_availabilityimpact": null,
    "cvss_exploitablity": null,
    "cvss_remediationlevel": null,
    "cvss_reportconfidence": null,
    "cvss_collateraldamagepotential": null,
    "cvss_targetdistribution": null,
    "cvss_securityrequirementscr": null,
    "cvss_securityrequirementsir": null,
    "cvss_securityrequirementsar": null,
    "cvss_basescore": null,
    "cvss_basevector": null,
    "cvss_temporalscore": null,
    "cvss_environmentalscore": null,
    "cvss_environmentalvector": null,
    "metric": null,
    "vulnote": 142
}
