Draytek vulnerabilities

A vulnerability in Draytek products (AP903, AP912C, AP918R) stems from insecure configuration of the ripd.conf file, which contains a hardcoded weak password. An attacker with network access can exploit this to gain unauthorized control over the routing daemon.

A vulnerability in the CGI endpoint used for configuration uploads in Draytek devices allows attackers to upload a crafted kernel module, leading to arbitrary code execution. Multiple router and VPN gateway models are affected before specific firmware versions.

A NULL pointer dereference vulnerability was found in Draytek devices. An attacker can send a crafted DHCP request, causing a Denial of Service (DoS).