Riskcovery

CVE-2025-10547

CVE-2025-10547

State
Published
Severity
9.8 Critical
Published
Oct 3, 2025
Updated
Nov 4, 2025
Reserved
Sep 16, 2025

Read the record on cve.org

Description

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Vigor1000BDrayTek Corporation
  • before 4.4.5.1Affected
Vigor2962DrayTek Corporation
  • before 4.4.5.1Affected
Vigor3910DrayTek Corporation
  • before 4.4.3.6Affected
Vigor3912DrayTek Corporation
  • before 4.4.5.1Affected
Vigor2135DrayTek Corporation
  • before 4.5.1Affected
Vigor2763DrayTek Corporation
  • before 4.5.1Affected
Vigor2765DrayTek Corporation
  • before 4.5.1Affected
Vigor2766DrayTek Corporation
  • before 4.5.1Affected
Vigor2865DrayTek Corporation
  • before 4.5.1Affected
Vigor2865 LTE SeriesDrayTek Corporation
  • before 4.5.1Affected
Vigor2865L-5G SeriesDrayTek Corporation
  • before 4.5.1Affected
Vigor2866DrayTek Corporation
  • 1.0 to before 4.5.1Affected
Vigor2866 LTEDrayTek Corporation
  • before 4.5.1Affected
Vigor2927DrayTek Corporation
  • before 4.5.1Affected
Vigor 2927 LTEDrayTek Corporation
  • before 4.5.1Affected
Vigor2927L-5GDrayTek Corporation
  • before 4.5.1Affected
Vigor2915DrayTek Corporation
  • before 4.4.6.1Affected
Vigor2862DrayTek Corporation
  • before 3.9.9.12Affected
Vigor2862 LTEDrayTek Corporation
  • before 3.9.9.12Affected
Vigor2926DrayTek Corporation
  • before 3.9.9.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.