CVE-2025-10547

9.8 criticalEPSS 0.6%

Critical (9.8). EPSS 0.6% chance of exploitation in the next 30 days.

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
Published: 2025-10-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/
https://www.kb.cert.org/vuls/id/294418

Check your stack JSON