This article discusses significant security vulnerabilities found in Draytek routers, which are commonly used in small office/home office settings. The vulnerabilities include weak authentication, insecure password storage, and the potential for arbitrary code execution through various flaws. These issues make the routers a prime target for attackers, posing risks to networks that rely on them. Affected: Draytek routers, small office/home office (SOHO) environments
Keypoints :
- Routers serve as essential gateways in networks, making them attractive targets for attackers.
- Many routers, including Draytek models, suffer from outdated firmware and security vulnerabilities.
- Multiple security issues were identified in Draytek routers, ranging from weak authentication to backdoor opportunities.
- Vulnerabilities lead to serious risks, including unauthorized access and remote code execution.
- Detailed findings include CVEs related to insecure password handling, predictable authentication codes, and buffer overflows.
MITRE Techniques :
- T1071: Application Layer Protocol – Attackers can manipulate HTTP protocols to exploit vulnerabilities in CGI configurations.
- T1203: Exploitation for Client Execution – Vulnerabilities allow arbitrary code execution through crafted requests.
- T1036: Masquerading – Weak authentication mechanisms permit attackers to masquerade as legitimate users.
- T1070: Indicator Removal on Host – Attackers may exploit undocumented features to cover tracks.
- T1499: Endpoint Denial of Service – The NULL pointer dereference vulnerability can lead to DoS attacks via crafted DHCP requests.
Views: 16