Draytek Routers APP Enforcement Module Upload Vulnerability Leading to Arbitrary Code Execution

A vulnerability exists in several Draytek router models, allowing attackers to upload malicious APP Enforcement modules that execute arbitrary code. This issue affects the Vigor 165/166 models prior to version 4.2.6, Vigor 2620/LTE200 models prior to version 3.9.8.8, Vigor 2860/2925 models prior to version 3.9.7, Vigor 2862/2926 models prior to version 3.9.9.4, Vigor 2133/2762/2832 models prior to version 3.9.8, Vigor 2135/2765/2766 models prior to version 4.4.5.1, Vigor 2865/2866/2927 models prior to version 4.4.5.3, Vigor 2962/3910 models prior to version 4.3.2.7, and Vigor 3912 models prior to version 4.3.5.2.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.