{"id":41270,"date":"2025-03-23T12:17:22","date_gmt":"2025-03-23T12:17:22","guid":{"rendered":"https:\/\/www.ispreview.co.uk\/?p=41270"},"modified":"2025-03-28T14:50:06","modified_gmt":"2025-03-28T14:50:06","slug":"broadband-isps-report-uk-connectivity-problems-with-vulnerable-draytek-routers","status":"publish","type":"post","link":"https:\/\/www.ispreview.co.uk\/index.php\/2025\/03\/broadband-isps-report-uk-connectivity-problems-with-vulnerable-draytek-routers.html","title":{"rendered":"Broadband ISPs Report UK Problems with Vulnerable DrayTek Routers UPDATE6"},"content":{"rendered":"

A number of broadband ISPs from across the United Kingdom (and possibly other countries too), such as ICUK and Andrews & Arnold (AAISP), have this weekend noticed an unusual increase in internet disconnections among customers who have DrayTek<\/a> routers at home or in the office. The issue seems to be caused by a “router vulnerability<\/em>“.<\/p>\n

Regular readers will know that DrayTek<\/strong> has been in the news a few times recently due to security vulnerabilities (here<\/a> and here<\/a>), although at this stage it’s not 100% clear if the latest event is due to one of those (i.e. an existing vulnerability that some customers have neglected to patch) or a newer exploit. But it appears to be the former.<\/p>\n

According to A&A, the issue of related broadband lines dropping and then reconnecting seems to have started at around 9:28pm on Saturday (22nd March 2025) and ran until this morning. Several other ISPs observed the same activity (examples here<\/a> and here<\/a>) and the providers soon started linking it to a small number of users with DrayTek routers. The issue impacted both broadband connections and leased lines.<\/p>\n

A&A Status Update @ Mar 23, 10:27AM<\/strong><\/p>\n

A problem with Draytek routers meant many around the country (or world?) had problems staying connected from 21:30PM on Saturday evening. We expect a software upgrade to resolve the problem and strongly suggest customers with Draytek routers upgrade their software or try a different make of router. We have sent SMS\/Emails to many of the affected customers pointing them to this status post. We have also emailed Draytek for comment.<\/p><\/blockquote>\n

ICUK Status Update @ Mar 23, 9:55AM<\/strong><\/p>\n

Since 21:30 yesterday evening we have witnessed an unusually high volume of session drops, primarily impacting BT<\/a> Wholesale and [PXC] broadband sessions. The cause has been narrowed down to vulnerable firmware versions on Draytek routers.<\/p>\n

If you are seeing broadband circuits exhibiting repeat short sessions, please upgrade the firmware to the latest version.<\/p>\n

Likewise, if you are also using Draytek routers to support any Leased Lines, please also review the firmware version before undertaking any further trouble shooting.<\/p><\/blockquote>\n

Suffice to say, it’s quite telling that the title of ICUK’s status update is “Draytek Router Vulnerability<\/em>“.<\/p>\n

UPDATE 24th March 2025 @ 7:28am<\/strong><\/p>\n

Some providers are still reporting problems with DrayTek routers. For example, we spotted an interesting update from business ISP Gamma at 7:40pm last night, which indicates that the “issues seemed to commence following a firmware update rolled out by them<\/em>“. The update doesn’t mention DrayTek by name, but the experiences match.<\/p>\n

Gamma Status Update – Issued 23\/03 19:40<\/strong><\/p>\n

Following on from the previous update all testing and data supports this being a CPE issue causing connectivity issues.<\/p>\n

Our findings and commonalities point the issue to customers using one make of CPE equipment as described via public communication available online and as raised by other ISPs. Although no direct comments from the third party at this time, issues seemed to commence following a firmware update rolled out by them circa 9:30pm last night.<\/p>\n

Gamma have worked with our network hardware vendor to see if a solution\/mitigation is viable. This has not been possible due to the issue being outside of our equipment.<\/p>\n

Thank you for your patience as we have investigated the root cause on this issue.<\/p>\n

Whilst the incident remains with a third party device and is not an active Gamma incident we will continue to monitor the situation tomorrow as we see traffic demand rise and then provide a further update at 9AM.<\/p><\/blockquote>\n

We are hoping to get a response from DrayTek today, which may help to shed some light on precisely what has occurred.<\/p>\n

UPDATE 24th March 2025 @ 9:57am<\/strong><\/p>\n

A&A has posted an additional update, which states that the problem “seems to be triggered by some sort of ‘attack’ against Draytek routers which have vulnerable software<\/em>“. The provider has not yet been able to get a response from DrayTek, but they propose three possible solutions (indications suggest that no.1 won’t work for everybody).<\/p>\n

A&A’s Proposed Solutions<\/strong><\/span><\/p>\n

Possible fix #1:<\/strong> We expect a software upgrade to resolve the problem and strongly suggest customers with Draytek routers upgrade their software or try a different make of router.<\/p>\n

Possible fix #2:<\/strong> If software upgrade does not help, then make sure remote access to the router is disabled, and any VPN service is disabled – especially the sslvpn and ssh vpn. (In GUI go to: VPN and Remote Access > Remote access control)<\/p>\n

Last resort fix #3:<\/strong> Replace the router with a different model (at least temporarily).<\/p><\/blockquote>\n

UPDATE 24th March 2025 @ 10:09am<\/strong><\/p>\n

Elsewhere, we’re hearing about similar issues occurring in Vietnam. According to a local distributor for the routers, An Phat, this is being caused by attacks that harness the previously reported critical security vulnerabilities including CVE-2024-51138, CVE-2024-51139, CVE-2024-41335, CVE-2024-41336, and CVE-2024-41339. But in the UK, we’ve also seen some patched DrayTek kit continuing to suffer. Hopefully DrayTek will issue a statement.<\/p>\n

UPDATE 24th March 2025 @ 12:14pm<\/strong><\/p>\n

For some context. Zen Internet<\/a>, which is home to a little under 200,000 broadband customers, has seen about 1,000 connections being impacted by this problem. Just to be clear, in most cases the DrayTek routers being impacted have not been supplied by ISPs, but are usually third-party purchases by customers themselves. Due to this, the ISP can only do so much to help impacted users address the problem.<\/p>\n

UPDATE 24th March 2025 @ 2:30pm<\/strong><\/p>\n

We’ve had an official response from DrayTek, but it seems to avoid commenting on the specific cause of the issue itself and simply provides a bunch of tips.<\/p>\n

DrayTek Statement<\/strong><\/p>\n

We have received reports of DrayTek routers disconnecting unexpectedly.<\/p>\n

If you are experiencing this issue, please follow the steps below to troubleshoot:<\/p>\n

    \n
  1. Disconnect the WAN cable.<\/li>\n
  2. Log into the router\u2019s Web UI and check the system uptime. If the uptime is lower than the last known reboot, this indicates the router recently restarted.<\/li>\n
  3. Disable Remote Management by going to [System Maintenance] > [Remote Management].<\/li>\n
  4. Disable SSL VPN Service by going to [VPN and Remote Access] > [Remote Access Control].<\/li>\n
  5. Reboot the router and reconnect the WAN cable.<\/li>\n
  6. Monitor the connection to see if the WAN remains stable.<\/li>\n<\/ol>\n

    Firmware check and update:<\/strong><\/p>\n