Dive Brief:

• Researchers warn that three older vulnerabilities in DrayTek routers have been actively exploited in recent weeks, which coincides with widespread reports of devices automatically rebooting in recent days, according to GreyNoise Intelligence.  
• Researchers said exploitation activity has been observed against three vulnerabilities, tracked as CVE-2020-8515, CVE-2021-20123 and CVE-2021-20124. 
• GreyNoise researchers said they cannot directly link the exploitation to the reboots. However, in a post on X Wednesday morning, DrayTek said the reboots appear to be linked to vulnerabilities disclosed in early March.

Dive Insight:

Exploitation of the older vulnerabilities has been observed for at least the last 45 days, according to GreyNoise. That specific activity includes the following: 

A remote code execution vulnerability, tracked as CVE-2020-8515, has been exploited in multiple DrayTek router models. Researchers observed activity from 82 IPs over the past 30 days, with Indonesia, Hong Kong and the U.S. as the top destinations of the attack traffic.

A directory traversal vulnerability in DrayTek Vigor Connect, tracked as CVE-2021-20123, has 23 IPs seen in the last 30 days. Top destinations include Lithuania, the U.S. and Singapore.

A second directory traversal vulnerability in DrayTek Vigor Connect, tracked as CVE-2021-20124, has 22 IPs observed in the past 30 days. Lithuania, the U.S. and Singapore are the top destinations. 

DrayTek said the reboots appear to be linked to a vulnerability disclosed earlier this month, though the company did not specify which one. Researchers from Faraday Security disclosed several vulnerabilities in a March 11 blog post. The report shows multiple security concerns, including weak authentication mechanisms, insecure kernel module updates and persistent opportunities for backdoors. 

DrayTek issued an advisory on March 4, urging customers to upgrade their firmware in connection with buffer overflow vulnerabilities, tracked as CVE-2024-51138 and CVE-2024-51139 and thanked Faraday for reporting the issues.   

The company said multiple buffer overflow vulnerabilities were identified in April 2024, and firmware fixes were released between August and October 2024. The company issued advisories earlier this month to encourage customers to check their versions.