DrayOS Router Flaw Allows Remote Code Execution by Attackers

A critical vulnerability affecting DrayOS routers could let unauthenticated attackers execute code remotely.

Discovered on July 22 by Pierre-Yves Maes of ChapsVision, the flaw stems from the use of an uninitialized variable in the Web User Interface (WebUI).

Crafting special HTTP or HTTPS requests to the WebUI triggers memory corruption, potentially crashing the device or allowing remote code execution in specific scenarios.

Impact and Exploitation

The weakness requires no valid credentials and can be exploited by any attacker with network access to the router’s WebUI.

While routers are typically shielded from wide-area-network (WAN) threats if WebUI and SSL VPN services are disabled or protected via Access Control Lists (ACLs), local attackers remain at risk.

On some models, LAN-side VLANs and ACLs offer additional control over WebUI access ...