DrayTek Routers at Heightened Risk: 14 New Firmware Vulnerabilities Discovered

Potentially tens of thousands of DrayTek routers are at an increased risk of attack due to the discovery of 14 new firmware vulnerabilities. These vulnerabilities, discovered by researchers at Forescout’s Vedere Labs, pose significant threats to businesses and government agencies that rely on DrayTek routers for their network infrastructure.

The vulnerabilities, which affect 24 different DrayTek router models, range from denial-of-service attacks to remote code execution and injection of malicious code into webpages. Two of the flaws are deemed critical and require immediate attention to prevent potential exploitation.

Forescout’s report, named Dray:Break, highlights the severity of the situation, especially considering the large number of routers exposed on the internet—over 704,000 units, primarily in Europe and Asia. The implications of a successful attack could be dire, leading to significant downtime, loss of customer trust, and regulatory penalties.

While DrayTek has released patches for all the vulnerabilities, including RCE bugs and OS command execution issues, organizations are advised to take proactive security measures to mitigate future risks. These measures include disabling remote access if not needed, verifying remote access profiles, using secure protocols, and ensuring proper network visibility.

The discovery of these vulnerabilities comes amidst a growing trend of threat actor activity targeting network devices from various vendors, including DrayTek. The FBI, NSA, and Cyber National Mission Force have warned of Chinese threat actors compromising routers and IoT devices for botnet operations and DDoS attacks.

The high number of critical vulnerabilities in DrayTek products over the years raises concerns about organizations’ ability to address security threats promptly. Many organizations lack visibility into unmanaged devices like routers, making it challenging to detect and patch vulnerabilities in their network infrastructure. Proactive security measures and timely patching are essential to safeguard against potential cyber attacks targeting vulnerable DrayTek routers.