by Kastro
Paper/Archive/CVE-2025-10547

CVE-2025-10547

DrayTek Corporation Vigor1000B — CVE-2025-10547

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.5.475 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

Affected

ProductAffectedFixed inSource
Vigor1000B< 4.4.5.14.4.5.1CNA
Vigor2962< 4.4.5.14.4.5.1CNA
Vigor3910< 4.4.3.64.4.3.6CNA
Vigor3912< 4.4.5.14.4.5.1CNA
Vigor2135< 4.5.14.5.1CNA
Vigor2763< 4.5.14.5.1CNA
Vigor2765< 4.5.14.5.1CNA
Vigor2766< 4.5.14.5.1CNA
Vigor2865< 4.5.14.5.1CNA
Vigor2865 LTE Series< 4.5.14.5.1CNA
Vigor2865L-5G Series< 4.5.14.5.1CNA
Vigor28661.0 – < 4.5.14.5.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdraytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilitiesrefkb.cert.org/vuls/id/294418