Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:03.670Z",
  "pubdate": "2026-08-24T18:17:03.670Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability localized within the jsonstatus function of the device firmware.\nThe security flaw stems from inadequate sanitization and filtering of user-supplied input passed through the usescript, usefile, and option fields prior to execution by the underlying operating system shell.\nSuccessful exploitation of this vulnerability enables a remote attacker to execute arbitrary system commands directly with root privileges, leading to a total compromise of the affected networking hardware.\nThe risk implications are severe, as unauthorized command execution at the highest privilege level allows threat actors to manipulate network traffic, intercept sensitive data, deploy persistent backdoors, or use the compromised switch as a pivot point into the internal network infrastructure.\nWhile the attack can be initiated remotely via the device's web management interface, exploitation strictly requires the attacker to possess valid administrative credentials to authenticate to the management console.\nAffected systems comprise multiple DrayTek VigorSwitch models that incorporate the vulnerable jsonstatus function within their web administration interface.",
  "technicalDetails": "The vulnerability resides in the jsonstatus function exposed by the web management interface of multiple DrayTek VigorSwitch models.\nThe root cause of the security defect is insufficient input validation and sanitization applied to specific HTTP parameters, specifically the usescript, usefile, and option fields, before the data is passed to the underlying system shell for execution.\nBecause the web application fails to properly escape or restrict metacharacters within these input vectors, an attacker can append malicious shell commands to the intended execution flow.\nThe attack vector is network-based, targeting the web management interface of the DrayTek VigorSwitch over protocols such as HTTP or HTTPS.\nAuthentication requirements dictate that the attacker must first obtain valid administrative credentials to successfully authenticate to the administrative web panel and access the vulnerable jsonstatus endpoint.\nPrivilege requirements are absolute; any injected payloads are executed directly with root privileges, granting the attacker unrestricted control over the underlying Linux-based operating system of the switch.\nThe exploitation flow proceeds as follows: First, the authenticated attacker crafts a malicious HTTP request targeting the jsonstatus function. Second, the attacker injects arbitrary shell commands into the usescript, usefile, or option fields. Third, the vulnerable application processes the input and forwards the unsanitized string to the system command interpreter. Finally, the operating system executes the injected payload with root privileges, allowing the attacker to achieve immediate system compromise and execute post-exploitation activities such as privilege persistence, network reconnaissance, or further lateral movement."
}