Cybersecurity company Forescout Technologies has released the DRAY:BREAK Research Report which identifies 14 previously unknown vulnerabilities in routers manufactured by DrayTek, a Taiwanese networking equipment manufacturer, including one with the highest possible severity rating of ten.
If left unaddressed, attackers could gain full control over these devices, opening the door to ransomware, denials of service and other attacks. With routers being increasingly targeted, this research spotlights the need for immediate action, including patching and disabling unnecessary remote access to protect network devices against rising cyber threats.
DrayTek routers are widely used across many industries and this broad usage has made them prime targets for cybercriminals. In addition to Forescout’s research, DrayTek routers were flagged in a recent FBI action and CISA added DrayTek vulnerabilities to the Known Exploited Vulnerabilities (KEV) list.
“Routers are crucial for keeping internal systems connected to the outside world yet too many organisations overlook their security until they are exploited by attackers,” said Forescout CEO Barry Mainz. “Cybercriminals work around the clock to find cracks in routers’ defences, using them as entry points to steal data or cripple business operations. Forescout’s DrayTek research is just the latest example to show how routers continue to be the riskiest device category across all assets.”
Key findings from the report include:
-
Fourteen vulnerabilities identified across DrayTek routers: The highest severity finding received a CVSS score of ten. Another scored a 9.1. These high-risk vulnerabilities can allow attackers to conduct remote code execution and OS command injection attacks. Further technical details are included in the full report.
-
Global widespread exposure: Over 704,000 DrayTek routers are currently exposed to the internet. More than 425,000 are in the UK and EU, and over 190,000 are in Asia. The report details a complete regional breakdown of exposure. The majority of the routers are intended for business use – with 75% used commercially. Nearly 40% of DrayTek routers are still vulnerable to similar issues identified two years ago and added to the CISA KEV catalogue.
-
End-of-Life devices at risk: The vulnerabilities found impact 24 DrayTek router models, 11 of which are end-of-life (EoL). Over two-thirds (63%) of the exposed devices are either End-of-sale (EoS) or EoL, making them more difficult to patch and protect.
Potential Attack Scenarios
DrayTek vulnerabilities create many potential router attack paths, especially for those with the web management interface exposed to the internet. Attackers can deploy a persistent rootkit to intercept and analyse network traffic, stealing sensitive data such as credentials or confidential information. Once inside, they could move laterally across the network, compromising other devices and potentially leading to ransomware, denial-of-service (DoS) attacks, or the creation of botnets for distributed attacks. High-performance routers, such as the Vigor3910, could even be repurposed as command-and-control (C2) servers, enabling attackers to launch further attacks on other victims.
As part of the responsible disclosure process, DrayTek has patched all the firmware vulnerabilities Vedere Labs uncovered. However, organisations still need to take mitigation steps to protect these products on their networks.
“To safeguard against these vulnerabilities, organisations must immediately patch affected DrayTek devices with the latest firmware. Disabling unnecessary remote access, implementing Access Control Lists and two-factor authentication, and monitoring for anomalies through syslog logging are all crucial steps,” said Forescout’s Head of Security Research Daniel dos Santos. “Network segmentation is also essential to contain any potential breaches, and outdated devices should be replaced.”
You can read the full report here.
