Read the docs
TI-2025-09652 Aliases CVE-2025-10547GHSA-crjf-w852-343r

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Fix Fixed Vigor1000B (DrayTek Corporation): 4.4.5.1Vigor2962 (DrayTek Corporation): 4.4.5.1+18 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor1000Bbefore 4.4.5.14.4.5.1Patch availableCNA
DrayTekVigor2962before 4.4.5.14.4.5.1Patch availableCNA
DrayTekVigor3910before 4.4.3.64.4.3.6Patch availableCNA
DrayTekVigor3912before 4.4.5.14.4.5.1Patch availableCNA
DrayTekVigor2135before 4.5.14.5.1Patch availableCNA
DrayTekVigor2763before 4.5.14.5.1Patch availableCNA
DrayTekVigor2765before 4.5.14.5.1Patch availableCNA
DrayTekVigor2766before 4.5.14.5.1Patch availableCNA
DrayTekVigor2865before 4.5.14.5.1Patch availableCNA
DrayTekVigor2865 LTE Seriesbefore 4.5.14.5.1Patch availableCNA
DrayTekVigor2865L-5G Seriesbefore 4.5.14.5.1Patch availableCNA
DrayTekVigor28661.0 to before 4.5.14.5.1Patch availableCNA
DrayTekVigor2866 LTEbefore 4.5.14.5.1Patch availableCNA
DrayTekVigor2927before 4.5.14.5.1Patch availableCNA
DrayTekVigor 2927 LTEbefore 4.5.14.5.1Patch availableCNA
DrayTekVigor2927L-5Gbefore 4.5.14.5.1Patch availableCNA
DrayTekVigor2915before 4.4.6.14.4.6.1Patch availableCNA
DrayTekVigor2862before 3.9.9.123.9.9.12Patch availableCNA
DrayTekVigor2862 LTEbefore 3.9.9.123.9.9.12Patch availableCNA
DrayTekVigor2926before 3.9.9.123.9.9.12Patch availableCNA
  • Vigor1000B VendorDrayTek Affected before 4.4.5.1 Fixed in 4.4.5.1 Patch available CNA
  • Vigor2962 VendorDrayTek Affected before 4.4.5.1 Fixed in 4.4.5.1 Patch available CNA
  • Vigor3910 VendorDrayTek Affected before 4.4.3.6 Fixed in 4.4.3.6 Patch available CNA
  • Vigor3912 VendorDrayTek Affected before 4.4.5.1 Fixed in 4.4.5.1 Patch available CNA
  • Vigor2135 VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2763 VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2765 VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2766 VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2865 VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2865 LTE Series VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2865L-5G Series VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2866 VendorDrayTek Affected 1.0 to before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2866 LTE VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2927 VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor 2927 LTE VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2927L-5G VendorDrayTek Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Vigor2915 VendorDrayTek Affected before 4.4.6.1 Fixed in 4.4.6.1 Patch available CNA
  • Vigor2862 VendorDrayTek Affected before 3.9.9.12 Fixed in 3.9.9.12 Patch available CNA
  • Vigor2862 LTE VendorDrayTek Affected before 3.9.9.12 Fixed in 3.9.9.12 Patch available CNA
  • Vigor2926 VendorDrayTek Affected before 3.9.9.12 Fixed in 3.9.9.12 Patch available CNA

Remediation

  • Fix · CNA Vigor1000B (DrayTek Corporation) Fixed in 4.4.5.1
  • Fix · CNA Vigor2962 (DrayTek Corporation) Fixed in 4.4.5.1
  • Fix · CNA Vigor3910 (DrayTek Corporation) Fixed in 4.4.3.6
  • Fix · CNA Vigor3912 (DrayTek Corporation) Fixed in 4.4.5.1
  • Fix · CNA Vigor2135 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2763 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2765 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2766 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2865 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2865 LTE Series (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2865L-5G Series (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2866 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2866 LTE (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2927 (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor 2927 LTE (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2927L-5G (DrayTek Corporation) Fixed in 4.5.1
  • Fix · CNA Vigor2915 (DrayTek Corporation) Fixed in 4.4.6.1
  • Fix · CNA Vigor2862 (DrayTek Corporation) Fixed in 3.9.9.12
  • Fix · CNA Vigor2862 LTE (DrayTek Corporation) Fixed in 3.9.9.12
  • Fix · CNA Vigor2926 (DrayTek Corporation) Fixed in 3.9.9.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-10547
  2. 2026-10-03 Alias added: GHSA-crjf-w852-343r

References

Other 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences