Security

High-end router flinger DrayTek admits to zero day in bunch of Vigor kit

'It may be possible for an attacker to intercept your router'

By Kat Hall

34 SHARE

Taiwanese network kit maker DrayTek has 'fessed up to a vulnerability in a large number of its routers which could allow miscreants to hijack internet traffic or steal personal data.

The flaw means attackers could remotely alter DNS settings on 28 Vigor model routers. DrayTek has released a series of firmware updates addressing the issue.

Users have complained about the problem for the last week on the AbuseIPDB forum. One noted the zero-day attack had infiltrated their servers, CRM and workstations.

"We now cannot log in as it is obvious this zero-day attack has changed our passwords including our VPN accounts [that] our remote users use to log in to the environment."

DrayTek routers are considered high end in the UK – retailing at around £200, more than twice the price of garden-variety alternatives – and are mostly used by businesses. In 2015, BT's Openreach accredited DrayTek for use of its very-high-bit-rate digital subscriber line 2 (VDSL2) fibre-to-the-cabinet products.

One business customer, who discovered his router was open to the vulnerability, told El Reg: "DrayTek routers are really expensive compared with other makes, they have an awful lot of features on them and this is the first known exploit I've come across."

In a statement, the company said:

We have become aware of security reports with DrayTek routers related to the security of web administration when managing DrayTek routers.

In some circumstances, it may be possible for an attacker to intercept or create an administration session and change settings on your router.

The reports appear to show that DNS settings are being altered. Specific improvements have been identified as necessary to combat this and we are in the process of producing and issuing new firmware. You should install that as soon as possible.

Until you have the new firmware installed, you should check your router's DNS settings on your router and correct them if changed (or restore from a config backup).

A survey by Broadband Genie recently found the vast majority of punters are potentially leaving themselves exposed by failing to change the password and security setting on their routers. ®

Sign up to our NewsletterGet IT in your inbox daily

34 Comments

More from The Register

G Suite'n'sour: Google resets passwords after storing some unhashed creds for months, years

Biz app login details encrypted at rest, though, ad giant insists

Brave accuses Google of trampling Europe's GDPR with stealthy netizen-stalking adverts

Our ads? Stomping on people's privacy? Never! Not us! sobs search giant

For Foxit's sake: PDF editor biz breached, users' passwords among stolen data

And they're imposing a 20-character limit on new ones

Google: All your leaked passwords are belong to us – here's a Chrome extension to find them

And I'm OK with this, says chief of HaveIBeenPwned

News aggregator app Flipboard hacked: All passwords reset after hackers pinch user data

Over half a billion installs? This one's not over yet, we reckon

2015 database hack is the terrible gift that keeps giving for Slack: Tens of thousands of passwords now reset

Yak app still cleaning up after four-year-old cyber-break-in

F-B-Yikes! FBI bod allegedly hid spy camera under desk to snap coworker's upskirt pics

Of all the places to allegedly try this, the J Edgar Hoover HQ ain't one. In fact, no, no building is good. None of them

FBI and immigration officials trawling US driving licence databases for suspects

Maybe time to put 4th amendment-bothering facial recog on ICE?

Google rolls out Android Easter Egg for Europe – a Microsoft antitrust-style browser, search engine choice box

Now how about we forget these fines, eh, mes amies? Meine Freunde? Mis amigos?

Add passwords to list of stuff CafePress made hash of storing, says infoseccer. 11m+ who used Facebook 'n' pals to sign in were lucky

11m other leaked users' p-words hashed with SHA-1