It would also be worth ensuring that all methods of remote access are disabled (i.e http, https, ftp, telnet, etc)
and that the TR069 feature is disabled too.
Since yesterday, March 22, 2025, there have been reports of a widespread issue affecting DrayTek routers in the UK, with some ISPs and users noting connectivity problems starting around 9:28 PM. Although specific details about the attack mechanism are not fully detailed in available sources as of March 23, 2025, I can provide an informed analysis based on recent vulnerabilities and attack patterns targeting DrayTek routers, which could align with this timeframe.
One likely mechanism involves the exploitation of known vulnerabilities in DrayTek Vigor routers, particularly those that remain unpatched. For instance, vulnerabilities like CVE-2024-51138 (a stack-based buffer overflow in the TR069 STUN server) and CVE-2024-51139 (an integer overflow in the CGI parser handling HTTP POST requests) were disclosed earlier in 2025. These flaws allow remote attackers to execute arbitrary code without authentication by sending specially crafted requests. The TR069 vulnerability, for example, could be triggered by an unauthenticated request to the router’s STUN server, potentially leading to full system compromise if the service is enabled. Similarly, the CGI POST flaw could enable heap overflows by manipulating the "Content-Length" header, resulting in remote code execution (RCE).
Given the timing—starting late on March 22—this could indicate a coordinated attack leveraging such vulnerabilities, possibly exacerbated by a new exploit or a variant of existing ones (e.g., those used by the Mirai botnet, which has historically targeted DrayTek devices). Posts on X and reports from ISPs like Zen Internet suggest a "nationwide issue" affecting DrayTek routers, hinting at a possible botnet or distributed attack. The Mirai botnet, known for incorporating DrayTek exploits (as noted in X posts from mid-March 2025), could be a candidate, using malformed packets or exploit chains to crash or hijack routers, leading to connectivity loss.
The mechanism likely involves:
1. **Initial Exploitation**: Attackers send malicious requests (e.g., via TR069 or CGI endpoints) to unpatched routers exposed to the internet, exploiting buffer overflows or command injection flaws.
2. **Payload Delivery**: Once access is gained, a payload could install malware, such as a botnet client, or disrupt router functionality (e.g., denial-of-service by crashing the device).
3. **Network Impact**: Compromised routers either stop routing traffic correctly or are used to propagate the attack, affecting downstream connectivity.
Since many DrayTek routers (over 700,000 globally, per 2024 reports) have exposed web interfaces and outdated firmware, the attack could exploit this widespread vulnerability surface. The sudden onset suggests either a zero-day exploit or rapid weaponization of a recently patched flaw, catching users who haven’t updated firmware off guard.
Without real-time forensic data specific to March 22, this remains speculative but aligns with known attack vectors and current sentiment on X about DrayTek issues. For confirmation, users should monitor official DrayTek advisories or ISP updates, as the situation is evolving as of 9:31 AM PDT today.
