On July 22, a security vulnerability was identified in DrayOS routers. The vulnerability can be triggered when unauthenticated remote attackers send crafted HTTP or HTTPS requests to the device's Web User Interface (WebUI). Successful exploitation may cause memory corruption and a system crash, with the potential, in certain circumstances, to allow remote code execution.

Routers are protected from WAN-based attacks if remote access to the WebUI and SSL VPN services is disabled, or if Access Control Lists (ACLs) are correctly configured. However, an attacker with access to the local network could still exploit the vulnerability via the WebUI. Local access to the WebUI can be managed on some models using LAN-side VLANs and ACLs. To achieve complete protection, it is strongly recommended to upgrade the firmware for affected router models.

Current router models with updated firmware versions are:

Vigor2962                            4.4.3.6 or later 4.4.5.1 or later

Vigor3910                            4.4.3.6 or later 4.4.5.1 or later

Vigor3912                            4.4.3.6 or later 4.4.5.1 or later

Vigor2135                            4.5.1 or later

Vigor2765                            4.5.1 or later

Vigor2865 Series              4.5.1 or later

Vigor2927 Series              4.5.1 or later

For a complete list of routers, refer to the list provided in the security advisory available at:

This video provides a brief overview of the upcoming DrayTek training workshop, scheduled to take place in Brisbane on November 4, 2025. DrayTek resellers, system integrators, and network administrators are invited to register for this valuable workshop.

Click here to watch this video.

More details on the workshop, including registration, are available at:

DrayTek HQ frequently sends notifications about system updates, outages, security alerts, and firmware releases.

Click here for the latest news from DrayTek HQ.