Skip to main content

CVE-2025-10547: Vigor routers face RCE risk via EasyVPN

Source Decision Insights Threat Desk Published October 3, 2025
Human View Machine View

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Late Majority

Our classification, not the publisher's statement. Best suited for, not only for.

Overview

A remote code execution (RCE) vulnerability, tracked as CVE-2025-10547, was discovered through the EasyVPN and Local Area Network (LAN) web administration interface of Vigor routers by Draytek. A script in the LAN web administration interface uses an unitialized variable, allowing an attacker to send specially crafted Hypertext Transfer Protocol (HTTP) requests that cause memory corruption and potentially allow arbitrary code execution.

Description

Vigor routers are business-grade routers, designed for small to medium-sized businesses, made by Draytek. These routers provide routing, firewall, Virtual Private Network (VPN), content-filtering, bandwidth management, LAN (LAN), and multi-WAN (WAN) features. Draytek utilizes a proprietary firmware, DrayOS, on the Vigor router line. DrayOS features the EasyVPN and LAN Web Administrator tool s to facilitate LAN and VPN setup. According to the DrayTek website, “with EasyVPN, users no longer need to generate WireGuard keys, import OpenVPN configuration files, or upload certificates. Instead, VPN can be successfully established by simply entering the username and password or getting the OTP code by email.”

The LAN Web Administrator provides a browser-based user interface for router management. When a user interacts with the LAN Web Administration interface, the user interface elements trigger actions that generate HTTP requests to interact with the local server. This process contains an uninitialized variable. Due to the uninitialized variable, an unauthenticated attacker could perform memory corruption on the router via specially crafted HTTP requests to hijack execution or inject malicious payloads. If EasyVPN is enabled, the flaw could be remotely exploited through the VPN interface.

Impact

A remote, unathenticated attacker can exploit this vulnerability through accessing the LAN interface—or potentially the Wide Area Network (WAN) interface—if EasyVPN is enabled or remote administration over the internet is activated. If a remote, unauthenticated attacker leverages this vulnerability, they can execute arbitrary code on the router (RCE) and gain full control of the device. A successful attack could result in a attacker gaining root access to a Vigor router to then install backdoors, reconfigure network settings, or block traffic. An attacker may also pivot for lateral movement via intercepting internal communications and bypassing VPNs.

Solution

The DrayTek Security team has developed a series of patches to remediate the vulnerability, and all users of Vigor routers should upgrade to the latest version ASAP. The patches can be found on the resources page of the DrayTek webpage, and the security advisory can be found within the about section of the DrayTek webpage. Consult either the Common Vulnerabilities and Exposures (CVE) listing or the advisory page for a full list of affected products.

Acknowledgements

Thanks to the reporter, Pierre-Yves MAES of ChapsVision ([email protected]). This document was written by Ayushi Kriplani.

Vendor Information

One or more vendors are listed for this advisory. Please reference the full report for more information.

References

Other Information

CVE Intrusion Detection System (IDS): CVE-2025-10547
Date Public: 2025-10-03
Date First Published: 2025-10-03
Date Last Updated: 2025-10-03 11:40 UTC
Document Revision: 2

Blog post, originally published by Ayushi Kriplani at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cve-2025-10547-vigor-routers-face-rce-risk-via-easyvpn/",
        "name": "CVE-2025-10547: Vigor routers face RCE risk via EasyVPN",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cve-2025-10547-vigor-routers-face-rce-risk-via-easyvpn/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "DrayTek"
    },
    "articleSection": [
      "Cybersecurity",
      "Data Center",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-24T10:36:41-06:00",
    "datePublished": "2025-10-03T09:30:43-06:00",
    "description": "CVE-2025-10547 affects Vigor routers, exposing users to remote code execution risks via the EasyVPN and LAN interfaces.",
    "headline": "CVE-2025-10547: Vigor routers face RCE risk via EasyVPN",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Ayushi Kriplani"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/294418"
    },
    "keywords": [
      "Common Vulnerabilities and Exposures",
      "Intrusion Detection System",
      "Local Area Network",
      "Router",
      "Virtual Private Network",
      "Vulnerabilities",
      "Wide Area Network"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cve-2025-10547-vigor-routers-face-rce-risk-via-easyvpn/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-24",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@type": "SoftwareSourceCode",
        "name": "OpenVPN"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "WireGuard"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages