Forescout Finds 14 Vulnerabilities in Popular DrayTek Routers Affecting Hundreds of Thousands of Exposed Devices Globally

Potential Attacks on DrayTek Routers May Include Espionage and Data Exfiltration, Lateral Movement, and Using Routers as Command-and-Control Servers

Forescout Technologies, Inc., a global cybersecurity leader, today published the “DRAY:BREAK” Research Report. The report identifies 14 previously unknown vulnerabilities in routers manufactured by DrayTek, a Taiwanese networking equipment manufacturer, including one with the highest possible severity rating of 10. If left unaddressed, attackers could gain full control over these devices, opening the door to ransomware, denials of service and other attacks. With routers being increasingly targeted, this research spotlights the need for immediate action including patching and disabling unnecessary remote access to protect network devices against rising cyber threats.

DrayTek routers are widely used across many industries and this broad usage has made them prime targets for cybercriminals. In addition to Forescout’s research, DrayTek routers were flagged in a recent FBI action and CISA added DrayTek vulnerabilities to the Known Exploited Vulnerabilities (KEV) list.

"Routers are crucial for keeping internal systems connected to the outside world yet too many organizations overlook their security until they are exploited by attackers,” said Barry Mainz, Forescout CEO. “Cybercriminals work around the clock to find cracks in routers' defenses, using them as entry points to steal data or cripple business operations. Forescout’s DrayTek research is just the latest example to show how routers continue to be the riskiest device category across all assets."

Forescout Research – Vedere Labs “DRAY:BREAK” Report Key Findings:

• 14 vulnerabilities identified across DrayTek routers: The highest severity finding received a CVSS score of 10; another scored a 9.1. These high-risk vulnerabilities can allow attackers to conduct remote code execution and OS command injection attacks. Further technical details are included in the full report.
• Global widespread exposure: Over 704,000 DrayTek routers are currently exposed to the internet. More than 425,000 are in the UK and EU, and over 190,000 are in Asia, a complete regional breakdown of exposure is detailed in the report. The majority of the routers are intended for business use — with 75% used commercially. Nearly 40% of DrayTek routers are still vulnerable to similar issues identified two years ago and added to the CISA KEV catalog.
• End-of-Life devices at risk: The vulnerabilities found impact 24 DrayTek router models, 11 of which are end-of-life (EoL). Over two-thirds (63%) of the exposed devices are either End-of-sale (EoS) or EoL, making them more difficult to patch and protect.

Potential Attack Scenarios

DrayTek vulnerabilities create many potential router attack paths, especially for those with the web management interface exposed to the internet. Attackers can deploy a persistent rootkit to intercept and analyze network traffic, stealing sensitive data such as credentials or confidential information. Once inside, they could move laterally across the network, compromising other devices and potentially leading to ransomware, denial-of-service (DoS) attacks, or the creation of botnets for distributed attacks. High-performance routers, such as the Vigor3910, could even be repurposed as command-and-control (C2) servers, enabling attackers to launch further attacks on other victims.

As part of the responsible disclosure process, DrayTek has patched all the firmware vulnerabilities Vedere Labs uncovered. However, organizations still need to take mitigation steps to protect these products on their networks.

"To safeguard against these vulnerabilities, organizations must immediately patch affected DrayTek devices with the latest firmware. Disabling unnecessary remote access, implementing Access Control Lists and two-factor authentication, and monitoring for anomalies through syslog logging are all crucial steps,” said Daniel dos Santos, Head of Security Research at Forescout Research – Vedere Labs. “Network segmentation is also essential to contain any potential breaches, and outdated devices should be replaced. "

To learn more about DrayTek vulnerability findings, including a technical deep dive and mitigation strategies, Forescout has published the full research report, a summary blog, and an on-demand webinar.

For the latest Forescout research, visit the Forescout – Vedere Labs website.

About Forescout

The Forescout cybersecurity platform provides complete asset intelligence and control across IT, OT, and IoT environments. For more than 20 years, Fortune 100 organizations, government agencies, and large enterprises have trusted Forescout as their foundation to manage cyber risk, ensure compliance, and mitigate threats. With seamless context sharing and workflow orchestration across more than 100 full-featured security and IT product integrations, Forescout makes every cybersecurity investment more effective.

Forescout Research – Vedere Labs is the industry leader in device intelligence, curating unique and proprietary threat intelligence that powers Forescout’s platform.

View source version on businesswire.com: https://www.businesswire.com/news/home/20241002638507/en/