Rooting DrayTek Routers Before Attackers Can - When Remote Shells Fall Into The Same Hole

This Black Hat conference talk explores how security researchers discovered Remote Code Execution vulnerabilities in DrayTek networking equipment before malicious actors could exploit them. Learn about the technical analysis of DrayTek devices—which include routers, VoIP gateways, firewalls, WiFi access points, and VPN concentrators—that share core software components and therefore common vulnerabilities. Discover how researchers Stanislav Dashevskyi and Francesco La Spina from Forescout Technologies not only achieved remote code execution on the latest VPN concentrator model but also found ways to escape the emulated environment to gain full device control. The presentation details vulnerabilities affecting DrayTek's entire product line (now patched) and discusses the potential impact had these security flaws been discovered by threat actors, particularly relevant given Chinese threat actors' previous targeting of these devices since 2018.