DrayTek, a manufacturer of broadband CPE (Customer Premises Equipment) such as routers, switches, firewalls, and VPN devices, announced today that hackers are exploiting a zero-day vulnerability to change DNS settings on some of its routers. A zero-day exploit is an attack that exploits a previously unknown security vulnerability.

The company are in the process of releasing updated firmware to address the issue and has also advised for users to immediately follow their advice and steps to ensure you are protected.

The company admitted to the attack after several users reported on Twitter about finding DrayTek routers with DNS settings changed and pointing to an unknown server located at 38.134.121.95.

It is said there are over 800,000 DrayTek devices connected online, albeit not all may be vulnerable to the unknown attacker’s exploit. Below is a list of possibly affected DrayTek device models:

Changing your DNS server address seems like a strange and minor setting to change for a hacker but DrayTek is saying it is likely to be ‘phase 1’ of a much larger attack. If someone can redirect you to a rogue DNS server, they can misdirect your browser to a fake site when you think you’re going to your favourite website. Then once you log in, the criminals have your username and password — another reason it is imperative to always use the two-factor login.

If you believe you may be affected, please follow DrayTek’s advice and update your device’s firmware immediately. The Firmware download page for UK/Irish users is here. Firmware has become available as of 18th May 2018 onwards with the very oldest models (>5 years) possibly not receiving updates.

If you have any questions or concerns regarding your DrayTek device, please be in touch with us at Should meetings be a laptop-free zone? →← Cloud backup and the best approach to secure your data