Skip to main content

CISA issues alert on Draytek Vigor routers RCE vulnerability via EasyVPN and LAN interfaces

Source Decision Insights Threat Desk Published November 26, 2025 Companies 1
Human View Machine View

330th article in the last 90 days, one of 438 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on Kiwire Captive Portal vulnerabilities and vendor fixes (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services

Our classification, not the publisher's statement. Best suited for, not only for.

Draytek's Vigor routers incorporating the DrayOS firmware exhibit a remote code execution vulnerability affecting the EasyVPN feature and Local Area Network (LAN) web administration interface. This security flaw allows attackers to inject commands into the device, enabling full control over affected routers.

The vulnerability, identified as CVE-2025-10547, impacts router versions running DrayOS with the EasyVPN and LAN Web Administrator components. It stems from a script in the LAN web interface using an uninitialized variable, which can be exploited through specially crafted Hypertext Transfer Protocol (HTTP) requests to the local server. When EasyVPN is active, the flaw extends to remote exploitation via the Virtual Private Network (VPN) interface. This memory corruption issue occurs without requiring authentication and targets the router’s handling of network interactions over HTTP.

Exploitation by a remote, unauthenticated attacker via LAN access or through Wide Area Network (WAN) interfaces—if EasyVPN is enabled or remote administration is active—can lead to arbitrary code execution. Successful attacks permit root-level access, allowing the installation of backdoors, network configuration changes, traffic obstruction, and potential lateral movement through intercepted internal communications and VPN bypass.

DrayTek has released patches addressing this vulnerability and recommends users update their Vigor router firmware promptly. Details and updates are available on DrayTek’s resources and security advisory web pages. The Common Vulnerabilities and Exposures (CVE) listing and advisory provide comprehensive information regarding the scope of affected products.

Users are encouraged to follow official guidance and refer to vendor resources for mitigation instructions. The advisory acknowledges the contribution of the vulnerability reporter and emphasizes adherence to provided updates for remediation.

Blog post, originally published by Ayushi Kriplani at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-draytek-vigor-routers-rce-vulnerability-via-easyvpn-and-lan-interfaces/",
        "name": "CISA issues alert on Draytek Vigor routers RCE vulnerability via EasyVPN and LAN interfaces",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-draytek-vigor-routers-rce-vulnerability-via-easyvpn-and-lan-interfaces/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "DrayTek"
    },
    "articleSection": [
      "Cybersecurity",
      "Data Center",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:17:47-06:00",
    "datePublished": "2025-11-26T01:27:57-07:00",
    "description": "Draytek Vigor routers running DrayOS firmware have a remote code execution flaw via EasyVPN and LAN interfaces requiring firmware updates.",
    "headline": "CISA issues alert on Draytek Vigor routers RCE vulnerability via EasyVPN and LAN interfaces",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Ayushi Kriplani"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/294418"
    },
    "keywords": [
      "Common Vulnerabilities and Exposures",
      "Firmware",
      "Local Area Network",
      "Router",
      "Virtual Private Network",
      "Vulnerabilities",
      "Wide Area Network"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-draytek-vigor-routers-rce-vulnerability-via-easyvpn-and-lan-interfaces/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages