We have become aware of a possible exploit of the Vigor2960 / 3900 / 300B related to the WebUI on 30th Jan. On 6th Feb 2020, we released an updated firmware to address this issue.

Necessary Action: Users of affected models should upgrade to 1.5.1 firmware or later as soon as possible.

Affected Products and the Fixed Firmware Version

Model	Fixed Firmware Version	Download Link
Vigor300B	1.5.1
Vigor2960	1.5.1
Vigor3900	1.5.1

The issue only affects the Vigor3900 / 2960 / 300B and is not known to affect any other DrayTek products.

Additional Precautions

• Check that no additional remote access profiles (VPN dial-in, teleworker or LAN to LAN) or admin users (for router admin) have been added.
• Check if any ACL (Access Control Lists) have been altered.
• Disable the remote access on your router if you don’t need it.
• Disable remote access (admin) and SSL VPN. The ACL does not apply to SSL VPN connections (Port 443) so you should also temporarily disable SSL VPN until you have updated the firmware.
• Always back up your config before doing an upgrade.
• After upgrading, do check that the web interface now shows the new firmware version.
• Enable syslog logging for monitoring if there are abnormal events.

Check here for other ways to improve network security.

Always Use Secure Protocols for Internet Activity

Regardless of this specific issue, Intercepting data can be made harder by always using secure protocols - HTTPS, TLS applied to email (see below) protocols, etc. Some protocols (FTP, Telnet, Syslog, IRC) should be avoided over the open internet - use equivalent secure protocols or VPNs where needed.

Your mail server and mail software/client (Outlook etc.) should be using secure transport. If you check your settings, secure protocols use different TCP port. e.g. POP3 should use port 995, not 110. SMTP should use port 465, not 25 and IMAP should use port 993, not 143. (The actual port number doesn't actually mean it's secure; those are just the correct ports that would be used on a properly secured server. Check with your ISPfor the correct settings).

If you have remote access enabled on your router, disable it if you don't need it, and use an access control list (ACL) if possible. An ACL is a preset whitelist of permitted remote IP addresses who can remotely administer your router, blocking anyone else. Alternatively, permit remote administration only through a secure VPN or using VigorACS central management.

Update Mailing List

DrayTek users may subscribe to our mailing list on MyVigor Portal to receive regular notifications of firmware updates and as a general rule of best practice, always keep all of your products' firmware up to date and check for updates.