DrayTek Vigor Routers OS Command Injection Vulnerability

Successful exploitation allows arbitrary operating system command execution on the affected router. This can result in full compromise of the device, including unauthorized administrative control, alteration of configuration, disruption of network services, deployment of malware or botnet payloads, and use of the router as a foothold for further activity such as surveillance, persistence, or DDoS operations.

If immediate patching is not possible, restrict access to the web management interface to trusted administrative networks only, remove public Internet exposure, and require access through a VPN or equivalent controlled management path. Apply firewall rules to limit management-plane reachability, monitor management and authentication logs for suspicious activity, and review devices for signs of unauthorized configuration changes or post-exploitation behavior. Strong administrative authentication and segmentation of network infrastructure can reduce exposure while patching is pending.

Upgrade affected DrayTek Vigor2960 and Vigor300B devices from firmware version 1.5.1.4 to version 1.5.1.5 or later. After upgrading, verify the installed firmware version and confirm normal device operation. Because the vulnerability has been publicly disclosed and exploitation has been reported, remediation should be prioritized for any exposed or internet-reachable management interface.