CVE-2025-10547: DrayTek Corporation Vigor1000B

Описание

Оригинално описание

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

Засегнати продукти

• DrayTek Corporation Vigor1000B: преди 4.4.5.1
• DrayTek Corporation Vigor2962: преди 4.4.5.1
• DrayTek Corporation Vigor3910: преди 4.4.3.6
• DrayTek Corporation Vigor3912: преди 4.4.5.1
• DrayTek Corporation Vigor2135: преди 4.5.1
• DrayTek Corporation Vigor2763: преди 4.5.1
• DrayTek Corporation Vigor2765: преди 4.5.1
• DrayTek Corporation Vigor2766: преди 4.5.1
• DrayTek Corporation Vigor2865: преди 4.5.1
• DrayTek Corporation Vigor2865 LTE Series: преди 4.5.1
• DrayTek Corporation Vigor2865L-5G Series: преди 4.5.1
• DrayTek Corporation Vigor2866: 1.0 преди 4.5.1
• DrayTek Corporation Vigor2866 LTE: преди 4.5.1
• DrayTek Corporation Vigor2927: преди 4.5.1
• DrayTek Corporation Vigor 2927 LTE: преди 4.5.1
• DrayTek Corporation Vigor2927L-5G: преди 4.5.1
• DrayTek Corporation Vigor2915: преди 4.4.6.1
• DrayTek Corporation Vigor2862: преди 3.9.9.12
• DrayTek Corporation Vigor2862 LTE: преди 3.9.9.12
• DrayTek Corporation Vigor2926: преди 3.9.9.12

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2025-10547
• https://nvd.nist.gov/vuln/detail/CVE-2025-10547
• https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/
• https://www.kb.cert.org/vuls/id/294418