DrayTek released firmware updates addressing 14 security vulnerabilities collectively dubbed DRAY:BREAK, discovered by Forescout Vedere Labs across its enterprise and residential Vigor routers. The most severe flaw, CVE-2024-41592 (CVSS 10.0), is an unauthenticated stack buffer overflow in the web user interface’s GetCGI() function triggered by parsing malformed query strings on exposed CGI endpoints. Chained with CVE-2024-41585 (CVSS 9.1)—an OS command injection vulnerability in the recvCmd inter-process communication binary on multi-core architectures like Vigor 3910 and 3912—an unauthenticated remote attacker can escape host sandboxes and execute arbitrary commands with root privileges on the underlying Linux host OS.

Internet telemetry identified over 704,500 DrayTek routers exposing administrative web interfaces directly to the WAN, leaving them susceptible to external takeover. Edge networking appliances from DrayTek have been repeatedly targeted by state-sponsored actors and botnets—such as Hiatus and earlier zero-day campaigns—for stealthy command-and-control pivoting and credential harvesting. DrayTek issued patches across dozens of active and end-of-life device families, strongly urging operators to deploy updated firmware and disable remote WAN management.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Chaining pre-authentication buffer overflows with inter-process command injection collapses edge perimeter controls, granting unauthenticated attackers root persistence beneath host firewalls and direct pivot access into internal networks.
• Bullet 2 — Strategic & Defender Imperative: Defenders must immediately apply vendor firmware updates, disable external WAN management access, restrict administrative portals to dedicated management VLANs, and inspect edge egress traffic for anomalous command-and-control proxies.