DrayTek, a networking equipment manufacturer, has issued an advisory about a vulnerability that affects several Vigor router models. The flaw allows remote, unauthenticated attackers to execute arbitrary code.
The vulnerability has been assigned the identifier CVE-2025-10547 and was discovered in the summer of this year by ChapsVision information security researcher Pierre-Yves Maes.
“The vulnerability is triggered when unauthenticated remote attackers send specially crafted HTTP or HTTPS requests to the device’s web interface,” the DrayTek security bulletin says. “Successful exploitation can lead to memory corruption and system crashes and, under certain circumstances, potentially allow remote code execution.”
DrayTek notes that exposure to WAN-side attacks can be reduced by disabling remote access to the web interface and SSL VPN (restricting it with ACLs and VLANs). However, the web interface remains accessible via the LAN, which exposes it to potential local attackers.
As Maes told Bleeping Computer, the root cause of CVE-2025-10547 lies in an uninitialized stack value that can be exploited to force the free() function to operate on arbitrary memory regions (arbitrary free), ultimately achieving remote code execution.
The researcher notes that he successfully tested the bug by creating a PoC exploit and running it on a vulnerable device. He promises to disclose all the technical details of CVE-2025-10547 later this week.
The devices listed below are vulnerable to CVE-2025-10547; it is recommended to update them to the specified firmware versions, where the issue has already been fixed.
- Vigor1000B, Vigor2962, Vigor3910/3912 -> 4.4.3.6 or newer (4.4.5.1 for some models);
- Vigor2135, Vigor2763/2765/2766, Vigor2865/2866 Series (including LTE and 5G), Vigor2927 Series (including LTE and 5G) -> 4.5.1 or newer;
- Vigor2915 Series -> 4.4.6.1 or newer;
- Vigor2862/2926 Series (including LTE) -> 3.9.9.12 or newer;
- Vigor2952/2952P, Vigor3220 -> 3.9.8.8 or newer;
- Vigor2860/2925 Series (including LTE) -> 3.9.8.6 or newer;
- Vigor2133/2762/2832 Series -> 3.9.9.4 or newer;
- Vigor2620 Series -> 3.9.9.5 or newer;
- VigorLTE 200n -> 3.9.9.3 or newer.