DrayTek Weekly Updates 1 September 2026
Security Advisory Updates
1. Multiple Remote Code Execution and Buffer Overflow Vulnerabilities in VigorAP Series
On June 1, several
potential security vulnerabilities were identified in the DrayTek VigorAP,
including buffer overflow conditions and improper sanitisation of special
characters used in operating system commands. We have promptly addressed these
issues, and firmware updates are available. Please ensure your devices are
running the patched versions.
Click here to read the detailed security advisory notice: Number: DSA-2026-002
2. Multiple Vulnerabilities in VigorSwitch Series
On June 1, several
potential security vulnerabilities were identified within the DrayTek
VigorSwitch mainfunction.cgi component, including Command Injection, Null
Pointer Dereference, Directory Traversal and Buffer Overflow. We have promptly
addressed these issues, and firmware updates are available. Please ensure your
devices are running the patched versions.
Click here to read the detailed security advisory notice: Number: DSA-2026-003
Latest Knowledge Base Article
Setting Up Cloudflare Dynamic DNS on Vigor Router
This article explains the benefits of using Cloudflare Dynamic DNS and demonstrates how to configure Cloudflare DDNS on a Vigor Router.
Click here to read the article.
Latest Firmware
New Features
· Support dual-WAN Load Balance and Failover, with per-WAN Weight for Primary and Failover members.
· Support TR-369 (USP) device management via ACS.
· Add SMS Gateway to Configuration >> LTE.
· Allow specifying a hostname as the source IP for NAT and Port Forwarding rules.
· Increase the maximum number of failover members from 5 to 10.
· Support Threat Protection (for Vigor2136ax-4G).
Improvements
· Improved security issues were identified during the internal SDL product security check.
· Reduced the LTE failover time.
· Overhaul VoIP parameter handling.
· Update OpenSSL version from 3.6.0 to 3.6.3.
For a detailed list of new features and improvements, refer to the release notes in the download link below:
Click here to download the firmware.
Improvements
· Updated the Wi-Fi driver with security improvements (CVE-2025-20674, CVE-2026-20452)
· Improved security by addressing CVE-2025-6965
Click
here to download the
firmware.
Improvements
· Enhance security validation for system input handling.
· Improve transmission performance during 5G wireless and WAN1 throughput testing.
· Optimise 10G NAT performance to improve upload throughput in high-speed network environments
· Fixed: VPN connections could disconnect unexpectedly in certain situations
Click here to download the firmware
New Features
· Add Cloudflare as a Dynamic DNS service provider
· Add a firmware update reminder in System Maintenance and Dashboard
· Add an enable/disable switch for the administrator block page in CSM >> DNS Filter. The switch is disabled by default to reduce CPU utilisation.
Improvements
Reboot / Crash / Freeze / High CPU
· Fixed: Recursive decapsulation of WireGuard packets caused a crash
· Fixed: An uninitialized-pointer issue in TR-069 that could cause the router to reboot repeatedly
· Fixed: A malformed response from a customised DDNS server caused the router to reboot.
· Fixed: Accessing TR-069 CLI parameters before interface initialisation caused read failures or a reboot
For a full list of improvements, refer to the firmware release notes at the link below.
Click here to download the firmware
New Features
· Add Cloudflare as a Dynamic DNS service provider
· Add a firmware update reminder in System Maintenance and Dashboard
·
Add an enable/disable switch for the
administrator block page in CSM >> DNS Filter. The switch is disabled by
default to reduce CPU utilisation.
Improvements
Reboot / Crash / Freeze / High CPU
· Fixed: Recursive decapsulation of WireGuard packets caused a crash
· Fixed: An uninitialized-pointer issue in TR-069 that could cause the router to reboot repeatedly
· Fixed: A malformed response from a customised DDNS server caused the router to reboot.
· Fixed: Accessing TR-069 CLI parameters before interface initialisation caused read failures or a reboot
For a full list of improvements, refer to the firmware release notes at the link below.
Click
here to download the
firmware
New Features
· Add Cloudflare as a Dynamic DNS service provider
· Add a firmware update reminder in System Maintenance and Dashboard
·
Add an enable/disable switch for the
administrator block page in CSM >> DNS Filter. The switch is disabled by
default to reduce CPU utilisation.
Improvements
Reboot / Crash / Freeze / High CPU
· Fixed: Recursive decapsulation of WireGuard packets caused a crash
· Fixed: An uninitialized-pointer issue in TR-069 that could cause the router to reboot repeatedly
· Fixed: A malformed response from a customised DDNS server caused the router to reboot.
· Fixed: Accessing TR-069 CLI parameters before interface initialisation caused read failures or a reboot
For a full list of improvements, refer to the firmware release notes at the link below.
Click here to download the
firmware
New Features
· Support TR369
· Support client limit for each Wireless SSI
· Fixed: An issue with the ARP request across different SSIDs
· Fixed: External RADIUS entries could not be deleted.
· Fixed: Wireless SSID Configuration failed with error message "Incorrect input format”
· Fixed: Wireless clients could not connect when WPA3 Enterprise was enabled.
· Fixed: Node Device Configuration failed with error message "Field operation failed (lost, duplicated, type...etc)"
· Fixed: TR-069 settings were not automatically saved after being pushed through the router's Wireless Virtual Controller
Click here to download the firmware
Latest Software
Improvement
· Fixed: WAN information from WAN interfaces other than WAN1 was not sent to Syslog.
Click here to download
Latest Apps
DrayTek Router (Android) V1.3.9
What's new
· Meet Google Play's target API level requirement. Supports Android 16 (API level 36) or higher
· Adjust the security permissions for camera and photo album access within the app
Click here to download
What's new
Fixed an issue where the app crashed after connecting to Vigor2767/Vigor2136
Click here to download
Smart VPN Client (Android) V1.7.1
What's new
· System Update: Upgraded to target API 37 to enhance compatibility and security on the latest Android devices.
· Connection Fix: Resolved an issue where Smart VPN could not connect to the VPN matcher.
· Connection Fix: Resolved an issue that caused EasyVPN connection failures on 5G/4G cellular networks.
· Bug Fix: Resolved an issue where the EasyVPN (WireGuard) static DNS assignment was not working.
· Localisation: Corrected translation errors in the Portuguese language interface.
Click here to download.
What's new
· Improved: Unify wording for TOTP secret key
· Fixed: Port Knocking function did not work
· Fixed: Route control for EasyVPN (WireGuard) did not work
· Fixed: “Send All Traffic” and “Ignore Server Routes” options in EasyVPN (Auto Mode) did not work correctly
Click here to download.
Calendar Events from DrayTek HQ
DrayTek HQ frequently sends notifications about system updates, outages, security alerts, and firmware releases.
Click here for the latest news from DrayTek HQ.
To subscribe to our regular news updates, click “Subscribe” on this page or log into your i-helpdesk account and enable the “Subscribe” option.