Draytek routers are common edge devices and valuable targets for attackers. Building on our DEFCON32 presentation—where we exposed six vulnerabilities and released the Draytek Arsenal toolkit—we now reveal two new unauthenticated RCEs: CVE-2024-51138 (a STUN CGI buffer overflow) and CVE-2024-51139 (an integer overflow in CGI parsing). Chained with previous persistence techniques, these flaws enable full remote takeover and backdooring.

This talk presents a detailed breakdown of both vulnerabilities, live demos, and an end-to-end exploitation chain. We also discuss a possible connection to the March 2025 mass reboot events, suggesting active exploitation in the wild. The session offers deep insights into embedded device exploitation, persistent access, and the value of open tools in security research.