CVE-2025-10547

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/
https://www.kb.cert.org/vuls/id/294418

Configurations

No configuration.

History

No history.

Information

Published : 2025-10-03 12:15

Updated : 2026-06-17 08:28

NVD link : CVE-2025-10547

Mitre link : CVE-2025-10547

CVE.ORG link : CVE-2025-10547

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-10547", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10547", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T14:33:21.692268Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "DrayTek Corporation", "product": "Vigor1000B", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2962", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor3910", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.3.6", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor3912", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2135", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2763", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2765", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2766", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2865", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2865 LTE Series", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2865L-5G Series", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2866", "versions": [{"status": "affected", "version": "1.0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2866 LTE", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2927", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor 2927 LTE", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2927L-5G", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2915", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.6.1", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2862", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.9.12", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2862 LTE", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.9.12", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "Vigor2926", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.9.12", "versionType": "custom"}]}]}], "published": "2025-10-03T12:15:42.993", "references": [{"url": "https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/", "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/294418", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption."}], "lastModified": "2026-06-17T08:28:30.000", "sourceIdentifier": "cret@cert.org"}