dbfb > News and resources > Draytek router update information

Draytek router update information

We’d like to inform you of a confirmed vulnerability affecting some of the DrayTek products that has been identified by the manufacturer during testing.

The best practice recommendation is to always keep firmware up to date, but DrayTek are highly recommending that you check that affected units are running at least the firmware version in the table below.

If the model is not listed below, it is not affected by this vulnerability.

 

Affected ModelFixed Firmware Version
Vigor39104.3.1.1
Vigor2962 Series4.3.1.1
Vigor2927 Series4.4.0
Vigor2927 LTE Series4.4.0
Vigor2915 Series4.3.3.2
Vigor2866 Series4.4.0
Vigor2866 LTE Series4.4.0
Vigor2865 Series4.4.0
Vigor2865 LTE Series4.4.0
Vigor2862 Series3.9.8.1
Vigor2862 LTE Series3.9.8.1
Vigor28323.9.6.1
Vigor2766 Series4.4.2
Vigor2765 Series4.4.2
Vigor2762 Series3.9.6.4
Vigor2620 LTE Series3.9.8.1
VigorLTE 200n3.9.8.1
Vigor2135 Series4.4.2
Vigor1000B4.3.1.1
Vigor1664.2.4
Vigor1654.2.4
Vigor3220 Series3.9.7.2
Vigor2952 / 2952P3.9.7.2
Vigor2926 Series3.9.8.1
Vigor2926 LTE Series3.9.8.1
Vigor2925 Series3.9.2
Vigor2925 LTE Series3.9.2
Vigor29123.8.15
Vigor2860 Series3.9.2
Vigor2860 LTE Series3.9.2
Vigor2133 Series3.9.6.4

 

Recommended actions

  1. If you have not already upgraded, update your firmware immediately. Before doing the upgrade, take a backup of your current config in case you need to restore it later (system maintenance -> Config Backup). Do use the .ALL file to upgrade, otherwise you will wipe your router settings. If you are upgrading from a much older firmware then please check the release notes carefully for any upgrading instructions.
  2. If you have remote access enabled on your router, disable it if you don’t need it, and use an access control list and 2FA if possible. If your unit is not already running patched firmware (see table above), disable remote access (admin) and SSL VPN. The ACL does not apply to SSL VPN connections (Port 443) so you should also temporarily disable SSL VPN until you have updated the firmware.

 

If you would like to discuss this further, or require our assistance in ensuring your equipment is secure, please contact customer services on:

01604 673320 | delight@dbfb.co.uk