Description

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:02.947Z",
  "pubdate": "2026-08-24T18:17:02.947Z",
  "executiveSummary": "Multiple DrayTek VigorAP models suffer from a critical buffer overflow vulnerability localized within the setLan function of the device management interface.\nThe security flaw stems from the absence of rigorous length validation checks during memory copy operations handling specific network configuration parameters.\nA remote authenticated attacker who successfully acquires valid administrative credentials for the web management interface can exploit this vulnerability by submitting crafted input to the vulnerable function.\nSuccessful exploitation of this flaw can lead to a complete denial of service condition, disrupting device availability, or potentially allow the execution of arbitrary commands within the context of the running application.\nGiven that exploitation requires prior administrative authentication, the primary risk involves privilege abuse, lateral movement, or complete compromise of the affected network access point by an adversary with elevated access.\nMitigation requires careful restriction of administrative access interfaces and adherence to vendor-supplied firmware updates as they become available.",
  "technicalDetails": "The vulnerability resides in the setLan function handling internal network configurations across multiple DrayTek VigorAP models.\nThe root cause of the vulnerability is the improper implementation of boundary constraints and missing length checks during memory copy operations.\nSpecifically, the vulnerable memory copy operations process input fields designated as lanVlanId0, lanIp, and lanNetmask.\nBecause the application fails to validate the size of the incoming data against the allocated buffer size prior to copying, supplying maliciously crafted input exceeding expected lengths triggers a classic stack-based or heap-based buffer overflow.\nThe attack vector is network-based, targeting the web management interface exposed by the affected DrayTek VigorAP devices.\nExploitation prerequisites strictly require the attacker to possess valid administrative credentials to access the device web management interface and invoke the vulnerable setLan function.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious HTTP request directed at the web management interface containing oversized payloads targeting the lanVlanId0, lanIp, or lanNetmask parameters.\nSecond, the server-side setLan function processes the request and executes memory copy routines without verifying the length of the parameters.\nThird, the excess input overflows the predefined memory buffer, overwriting adjacent memory regions, control data, or execution registers.\nDepending on the nature of the overwritten memory and the specific payload delivered, this memory corruption either abruptly crashes the process resulting in a denial of service, or corrupts instruction pointers to achieve arbitrary command execution under the privileges of the web management daemon.\nDue to the administrative privilege level required for execution, successful post-exploitation impact includes full administrative control over the access point, persistent tampering with device configurations, or pivoting into the local network segment."
}