Saint DRAY:BREAK, Who Broke the DrayTek Routers

Patron of office routers forgotten under the desk, end-of-life models, and web panels exposed to the Internet.

Life

On 2 October 2024 Forescout published fourteen vulnerabilities in DrayTek Vigor routers, one of them, an overflow in the web interface, with the maximum score of 10. Over 700,000 devices were exposed to the Internet, and eleven of the twenty-four affected models were already end-of-life. It wasn't the first procession: several earlier DrayTek bugs were already in CISA's catalogue of exploited vulnerabilities.

Prayer

O Saint DRAY:BREAK, who comes in through the panel nobody closed, let our routers not talk to the whole world. Amen.

How to celebrate

Celebrated by updating DrayTek firmware, taking the web interface off the Internet and retiring the end-of-life router with a small ceremony.

Old routers never die: they just get popped.