{"id":"CVE-2025-10547","state":"PUBLISHED","title":"CVE-2025-10547","description":"An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.","publishedAt":"2025-10-03T11:35:43.752Z","updatedAt":"2025-11-04T22:06:30.559Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"certcc","products":["DrayTek Corporation Vigor1000B","DrayTek Corporation Vigor2962","DrayTek Corporation Vigor3910","DrayTek Corporation Vigor3912","DrayTek Corporation Vigor2135","DrayTek Corporation Vigor2763","DrayTek Corporation Vigor2765","DrayTek Corporation Vigor2766","DrayTek Corporation Vigor2865","DrayTek Corporation Vigor2865 LTE Series","DrayTek Corporation Vigor2865L-5G Series","DrayTek Corporation Vigor2866","DrayTek Corporation Vigor2866 LTE","DrayTek Corporation Vigor2927","DrayTek Corporation Vigor 2927 LTE","DrayTek Corporation Vigor2927L-5G","DrayTek Corporation Vigor2915","DrayTek Corporation Vigor2862","DrayTek Corporation Vigor2862 LTE","DrayTek Corporation Vigor2926"],"affected":[{"vendor":"DrayTek Corporation","product":"Vigor1000B","versions":[{"version":"0","status":"affected","lessThan":"4.4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2962","versions":[{"version":"0","status":"affected","lessThan":"4.4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor3910","versions":[{"version":"0","status":"affected","lessThan":"4.4.3.6","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor3912","versions":[{"version":"0","status":"affected","lessThan":"4.4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2135","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2763","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2765","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2766","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2865","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2865 LTE Series","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2865L-5G Series","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2866","versions":[{"version":"1.0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2866 LTE","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2927","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor 2927 LTE","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2927L-5G","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2915","versions":[{"version":"0","status":"affected","lessThan":"4.4.6.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2862","versions":[{"version":"0","status":"affected","lessThan":"3.9.9.12","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2862 LTE","versions":[{"version":"0","status":"affected","lessThan":"3.9.9.12","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2926","versions":[{"version":"0","status":"affected","lessThan":"3.9.9.12","versionType":"custom"}]}],"references":["https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/","https://www.kb.cert.org/vuls/id/294418"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10547.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-10547","state":"PUBLISHED","datePublished":"2025-10-03T11:35:43.752Z","dateUpdated":"2025-11-04T22:06:30.559Z","assignerShortName":"certcc","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateReserved":"2025-09-16T11:35:24.694Z"},"containers":{"cna":{"title":"CVE-2025-10547","descriptions":[{"lang":"en","value":"An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption."}],"affected":[{"vendor":"DrayTek Corporation","product":"Vigor1000B","versions":[{"version":"0","status":"affected","lessThan":"4.4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2962","versions":[{"version":"0","status":"affected","lessThan":"4.4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor3910","versions":[{"version":"0","status":"affected","lessThan":"4.4.3.6","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor3912","versions":[{"version":"0","status":"affected","lessThan":"4.4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2135","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2763","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2765","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2766","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2865","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2865 LTE Series","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2865L-5G Series","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2866","versions":[{"version":"1.0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2866 LTE","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2927","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor 2927 LTE","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2927L-5G","versions":[{"version":"0","status":"affected","lessThan":"4.5.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2915","versions":[{"version":"0","status":"affected","lessThan":"4.4.6.1","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2862","versions":[{"version":"0","status":"affected","lessThan":"3.9.9.12","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2862 LTE","versions":[{"version":"0","status":"affected","lessThan":"3.9.9.12","versionType":"custom"}]},{"vendor":"DrayTek Corporation","product":"Vigor2926","versions":[{"version":"0","status":"affected","lessThan":"3.9.9.12","versionType":"custom"}]}],"references":[{"url":"https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-456: Missing Initialization of a Variable"}]}],"providerMetadata":{"shortName":"certcc","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateUpdated":"2025-10-20T15:58:45.010Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"VINCE 3.0.26","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2025-10547"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-10-03T14:33:21.692268Z","id":"CVE-2025-10547","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-16T18:32:38.126Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.kb.cert.org/vuls/id/294418"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T22:06:30.559Z"}}]}}}