CVE-2025-10547 PUBLISHED

CVE-2025-10547

Assigner: certcc
Reserved: 16.09.2025 Published: 03.10.2025 Updated: 04.11.2025

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

Product Status

Vendor DrayTek Corporation
Product Vigor1000B
Versions
  • affected from 0 to 4.4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2962
Versions
  • affected from 0 to 4.4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor3910
Versions
  • affected from 0 to 4.4.3.6 (excl.)
Vendor DrayTek Corporation
Product Vigor3912
Versions
  • affected from 0 to 4.4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2135
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2763
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2765
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2766
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2865
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2865 LTE Series
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2865L-5G Series
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2866
Versions
  • affected from 1.0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2866 LTE
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2927
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor 2927 LTE
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2927L-5G
Versions
  • affected from 0 to 4.5.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2915
Versions
  • affected from 0 to 4.4.6.1 (excl.)
Vendor DrayTek Corporation
Product Vigor2862
Versions
  • affected from 0 to 3.9.9.12 (excl.)
Vendor DrayTek Corporation
Product Vigor2862 LTE
Versions
  • affected from 0 to 3.9.9.12 (excl.)
Vendor DrayTek Corporation
Product Vigor2926
Versions
  • affected from 0 to 3.9.9.12 (excl.)

References

Problem Types

  • CWE-456: Missing Initialization of a Variable