CVE-2025-10547
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.6%
exploitation probability
0.6%top 54% of all CVEs
observed exploitation
nono source reports it
An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
DrayTek Corporation · Vigor1000BDrayTek Corporation · Vigor2135DrayTek Corporation · Vigor2763DrayTek Corporation · Vigor2765DrayTek Corporation · Vigor2766DrayTek Corporation · Vigor2862DrayTek Corporation · Vigor2862 LTEDrayTek Corporation · Vigor2865DrayTek Corporation · Vigor2865L-5G SeriesDrayTek Corporation · Vigor2865 LTE SeriesDrayTek Corporation · Vigor2866DrayTek Corporation · Vigor2866 LTEDrayTek Corporation · Vigor2915DrayTek Corporation · Vigor2926DrayTek Corporation · Vigor2927DrayTek Corporation · Vigor2927L-5GDrayTek Corporation · Vigor 2927 LTEDrayTek Corporation · Vigor2962DrayTek Corporation · Vigor3910DrayTek Corporation · Vigor3912