DrayTek routers worldwide go into reboot loops over weekend

As first reported by ISPreview, affected customers (including those in Australia and outside the UK) were told to upgrade their devices to the latest firmware, disable SSLVPN/Remote Access, or even switch to routers from other vendors if the issues weren't fixed. Impacted ISPs (including Gamma, Zen Internet, ICUK, and A&A in the United Kingdom and elsewhere) confirmed these reports and linked the Internet connection issues to attacks targeting unspecified vulnerabilities, knocking the routers offline, or a buggy software update pushed by DrayTek that caused impacted devices to enter a boot loop. "We urge customers to upgrade the DrayTek router to the latest firmware, or switch out the router entirely, to restore connectivity. Many Internet service providers (ISPs) worldwide are alerting customers of an outage that started Saturday night and triggered DrayTek router connectivity problems. In October, DrayTek also fixed critical security flaws that affected 24 router models and over 700,000 devices whose web user interface was exposed on the Internet. We have had confirmation from other end users that the latest firmware from DrayTek resolves the fault," Zen Internet said. While DrayTek has yet to reply to BleepingComputer's request for comment, it published a support document on Monday regarding this incident, providing guidance on addressing the router reboot issues. BleepingComputer has contacted DrayTek to ask if the reboot loops were caused by vulnerability exploitation or buggy firmware and will update if we hear back. If you are seeing broadband circuits exhibiting repeat short sessions, please upgrade the firmware to the latest version," ICUK added.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 24 Mar 2025 18:20:05 +0000


Cyber News related to DrayTek routers worldwide go into reboot loops over weekend

DrayTek Routers at Risk From 14 New Vulnerabilities - The advice comes amid signs of growing threat actor activity — including by nation-state actors — targeting vulnerabilities in routers and other network devices from DrayTek and a variety of other vendors, including Fortinet, F5, QNAP, Ivanti, ...
5 months ago Darkreading.com CVE-2024-41592 CVE-2024-41585 CVE-2021-20123 CVE-2021-20124
DrayTek routers worldwide go into reboot loops over weekend - As first reported by ISPreview, affected customers (including those in Australia and outside the UK) were told to upgrade their devices to the latest firmware, disable SSLVPN/Remote Access, or even switch to routers from other vendors if the issues ...
1 day ago Bleepingcomputer.com
14 New DrayTek routers' flaws impacts over 700,000 devices in 168 countries - Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. Multiple flaws in DrayTek ...
5 months ago Securityaffairs.com CVE-2024-45519 CVE-2024-29849 CVE-2024-41585
14 DrayTek Routers Vulnerabilities Let Hackers Hijacks 700K Devices Remotely - Researchers have identified fourteen new vulnerabilities in DrayTek Vigor routers, including a critical remote code execution flaw rated 10 out of 10 on the CVSS severity scale. Recent reports from the FBI indicate that Chinese government spies ...
5 months ago Cybersecuritynews.com
Alert: Over 700,000 DrayTek Routers Exposed to Hacking via 14 New Vulnerabilities - The development comes as cybersecurity agencies from Australia, Canada, Germany, Japan, the Netherlands, New Zealand, South Korea, the U.K., and the U.S. issued joint guidance for critical infrastructure organizations to help maintain a safe, secure ...
5 months ago Thehackernews.com
Award-Winning Centralized Platform Helps Unlock Value Through Simplicity - Network operators need to cater to their customers by delivering services from anywhere between 1G to 100G speeds, while having the ability to aggregate into 400G networks. With the evolution of the network and emergence of more localized and ...
1 year ago Feedpress.me
Remote Code Execution Vulnerabilities Discovered in TP-Link and Netcomm Routers - Latest research has uncovered alarming security vulnerabilities in popular TP-Link and Netcomm routers. The discovered vulnerabilities if exploited could potentially allow an attacker to gain unauthorized access to the routers and execute arbitrary ...
2 years ago Securityweek.com
Malware botnet bricked 600,000 routers in mysterious 2023 event - A malware botnet named 'Pumpkin Eclipse' performed a mysterious destructive event in 2023 that destroyed 600,000 office/home office internet routers offline, disrupting customers' internet access. According to researchers at Lumen's Black Lotus Labs, ...
9 months ago Bleepingcomputer.com
Malware botnet bricked 600,000 routers in mysterious 2023 attack - A malware botnet named 'Pumpkin Eclipse' performed a mysterious destructive event in 2023 that destroyed 600,000 office/home office internet routers offline, disrupting customers' internet access. According to researchers at Lumen's Black Lotus Labs, ...
9 months ago Bleepingcomputer.com
"Sierra:21" vulnerabilities impact critical infrastructure routers - A set of 21 newly discovered vulnerabilities impact Sierra OT/IoT routers and threaten critical infrastructure with remote code execution, unauthorized access, cross-site scripting, authentication bypass, and denial of service attacks. The flaws ...
1 year ago Bleepingcomputer.com
Feds Disrupt Botnet Used by Russian APT28 Hackers - Federal law enforcement kicked Russian state hackers off a botnet comprising at least hundreds of home office and small office routers that had been pulled together by a cybercriminal group and co-opted by the state-sponsored spies. APT28, an ...
1 year ago Securityboulevard.com Fancy Bear APT28 Volt Typhoon
Volt Typhoon Ramps Up Malicious Activity Against Critical Infrastructure - China-backed cyber espionage group Volt Typhoon is systematically targeting legacy Cisco devices in a sophisticated and stealthy campaign to grow its attack infrastructure. In many instances, the threat actor, known for targeting critical ...
1 year ago Darkreading.com Volt Typhoon
3 Ways to Use Real-Time Intelligence to Defeat Bots - These days, online businesses must grapple with their own version of the replicant dilemma, as they try to make it easy for their human customers to use their sites, while keeping out a new generation of human-like bots. Bots, of course, are hardly a ...
1 year ago Darkreading.com
Microsoft fixes Windows KB5043145 reboot loops, USB and Bluetooth issues - Previously, Microsoft resolved a known issue in August that caused boot problems and freezes on Windows Server 2019 systems and a bug in the July 2024 Windows security updates that caused some Windows devices to boot into BitLocker recovery. ...
5 months ago Bleepingcomputer.com
Stealthy KV-botnet hijacks SOHO routers and VPN devices - The Chinese state-sponsored APT hacking group known as Volt Typhoon has been linked to a sophisticated botnet named 'KV-botnet' since at least 2022 to attack SOHO routers in high-value targets. Volt Typhoon commonly targets routers, firewalls, and ...
1 year ago Bleepingcomputer.com Volt Typhoon
Security Series: Protecting the Edge Against DDoS Attacks with a Simplified Integrated Solution - An unprecedented increase in distributed-denial-of-service attacks in recent years has resulted in lost revenue and productivity, increased ransomware costs, and impacted service-level agreements for network operators. According to Zayo Group's ...
1 year ago Feedpress.me
New 5Ghoul attack impacts 5G phones with Qualcomm, MediaTek chips - The 5Ghoul attacks range from temporary service disruptions to network downgrades, which may be more severe from a security standpoint. The researchers discovered the flaws while experimenting with 5G modem firmware analysis and report that the flaws ...
1 year ago Bleepingcomputer.com CVE-2023-33042
Previously unidentified botnet infects unpatched TP-Link Archer home routers | The Record from Recorded Future News - Cato Networks found some evidence that the threat actor involved deploys tools to potentially steal data from infected networks.The IP address tied to the threat actor is no longer responding, the researchers said, adding that they have found a new ...
2 weeks ago Therecord.media CVE-2023-1389
Big China Spy Balloon Moving East Over US, Pentagon Says - The Pentagon said at midday Friday that a Chinese spy balloon had moved eastward and was over the central United States, and that the U.S. rejected China's claims that it was not being used for surveillance. Gen. Pat Ryder, Pentagon press secretary, ...
2 years ago Securityweek.com
Cisco Routers Exposed to Remote Code Execution (RCE) Attacks: How to Protect Your Network - Protecting networks from remote code execution (RCE) attacks is now more important than ever, as thousands of end-of-life Cisco routers are exposed to these vulnerabilities. On June 10, 2020 research revealed that over 19,000 Cisco devices were still ...
2 years ago Bleepingcomputer.com
Botnet Struck U.S. Routers; Here's How to Keep Employees Safe - State-sponsored hackers affiliated with China have targeted small office/home office routers in the U.S. in a wide-ranging botnet attack, Federal Bureau of Investigation Director Christopher Wray announced on Wednesday, Jan. 31. Most of the affected ...
1 year ago Techrepublic.com Volt Typhoon
FBI disrupts Moobot botnet used by Russian military hackers - The FBI took down a botnet of small office/home office routers used by Russia's Main Intelligence Directorate of the General Staff in spearphishing and credential theft attacks targeting the United States and its allies. This network of hundreds of ...
1 year ago Bleepingcomputer.com Fancy Bear APT28 Turla Volt Typhoon
Investigation of Possible Causes of ESXiArgs Ransomware Attacks Suggests VMware is Not at Fault - Edward Hawkins, the High-Profile Product Incident Response Manager at VMware, has denied allegations that two-year-old security flaws have been used in the current ESXiArgs ransomware attacks. Over the weekend, reports surfaced about cybercriminals ...
2 years ago Hackread.com CVE-2021-21974
The 5 Best VoIP Routers (Wired, Wireless, and Mesh) - As a VoIP router, it has everything you need, including redundant WAN ports for failover and load balancing, country-based QoS to prioritize VoIP traffic, outage reporting, VLAN traffic separation, support for various VPN connections, and LTE backup ...
5 months ago Techrepublic.com
Lockbit hit Wichita, AI export bans, Pathfinder on Intel - The pernicious ransomware organization added the city of Wichita to its leak site, giving officials until May 15th to pay an unspecified ransom. We previously covered the city's announcement of the attack over the weekend. In the wake of the attack, ...
10 months ago Cisoseries.com LockBit

Latest Cyber News


Cyber Trends (last 7 days)