Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:03.940Z",
  "pubdate": "2026-08-24T18:17:03.940Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability located within the commandTable function of the web management interface. This security defect stems from insufficient input sanitization and incomplete filtering of dangerous metacharacters, including backticks, newline characters, and single quotes, within the parameter field.\nSuccessful exploitation of this flaw allows a remote authenticated attacker to execute arbitrary system commands with ultimate root privileges on the underlying operating system. The primary risk implication is complete administrative compromise of the affected network infrastructure device, potentially enabling lateral movement, traffic interception, or denial of service across the managed network topology.\nAlthough exploitation yields full root-level control over the target hardware, the attack vector strictly requires the acquisition and utilization of valid administrative credentials to successfully interact with the web management interface. Consequently, threat actors must either compromise legitimate credentials through social engineering or credential stuffing, or exploit secondary vulnerabilities to gain initial authenticated access before this command injection vector can be leveraged.",
  "technicalDetails": "The vulnerability resides within the web management interface of multiple DrayTek VigorSwitch models, specifically targeting the commandTable function where user-supplied input parameters are processed. The fundamental root cause of the flaw is improper input validation and deficient sanitization routines that fail to adequately strip or escape dangerous shell metacharacters. Specifically, characters such as backticks, newline characters, and single quotes are permitted to pass through the parameter field into underlying system execution contexts without proper neutralization.\nThe vulnerable component is the parameter parsing logic associated with the commandTable function, which insecurely concatenates or passes tainted user input to underlying system shells or execution APIs. Because the application executes these routines with elevated privileges, any unescaped shell operators or command delimiters embedded within the crafted input are interpreted and executed by the operating system shell.\nThe attack flow proceeds as follows: First, the remote attacker must authenticate to the DrayTek VigorSwitch web management interface using valid administrative credentials, satisfying the mandatory authentication and privilege requirements. Second, the attacker crafts a malicious HTTP request directed at the web interface containing the commandTable function. Within the vulnerable parameter field, the attacker injects specialized payloads containing dangerous characters such as backticks, single quotes, or newline sequences designed to break out of the intended argument context and append arbitrary operating system commands.\nThird, the web application passes the unsanitized input to the backend execution environment. Due to the incomplete filtering mechanism, the embedded payload is processed as executable shell syntax rather than literal data. Finally, the operating system executes the injected commands, resulting in immediate arbitrary code execution under the security context of the root user.\nThe post-exploitation impact of this vulnerability is severe, granting the attacker unconstrained root-level access to the DrayTek VigorSwitch. With root privileges, an adversary can manipulate network configurations, install persistent backdoors, capture sensitive traffic, modify routing tables, or compromise other segments of the enterprise network connected to the switch."
}