Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:06.377Z",
  "pubdate": "2026-08-24T18:17:06.377Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability located within the webBackupAction function of the web management interface.\nThis vulnerability is classified as an improper neutralization of special elements used in an OS command, allowing authenticated remote attackers to execute arbitrary system commands with root privileges.\nThe affected systems include multiple DrayTek VigorSwitch models that process configuration backup and restore operations through the web interface.\nRisk implications are severe, as successful exploitation grants complete administrative control over the underlying operating system, potentially leading to total device compromise, network reconnaissance, lateral movement, and persistent persistence within the local network infrastructure.\nAttacker capabilities include the execution of arbitrary OS-level commands under the highest privilege context available on the device.\nExploitation strictly requires valid administrative credentials to access the web management interface, meaning the attack vector is limited to authenticated actors or unauthenticated actors leveraging prior credential compromise or session hijacking techniques.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization, validation, and filtering of user-supplied input parameters passed to system command execution routines within the webBackupAction function.\nSpecifically, the input fields option, key, pw_encode, pathN, and valueN fail to adequately neutralize shell metacharacters before the data is integrated into backend system calls.\nThe vulnerable component is the web management interface binary or CGI script responsible for handling backup and restore actions.\nNetwork exposure is defined by the accessibility of the administrative web management interface, which is typically exposed via HTTP or HTTPS on the management plane of the VigorSwitch.\nAuthentication requirements dictate that the attacker must possess valid administrative credentials to interact with the vulnerable webBackupAction endpoint.\nPrivilege requirements are absolute, requiring root-level execution capability once the command injection payload is successfully processed by the underlying operating system shell.\nThe attack flow proceeds as follows: First, the remote attacker authenticates to the DrayTek VigorSwitch web management interface using valid administrative credentials. Second, the attacker crafts a malicious HTTP request targeting the webBackupAction endpoint, embedding OS command injection payloads within parameters such as option, key, pw_encode, pathN, or valueN. Third, the web application accepts the crafted input and passes it directly or via insecure wrapper functions to the underlying operating system shell without proper sanitization. Fourth, the system executes the concatenated string, leading to the execution of arbitrary commands with root privileges.\nPayload behavior involves executing arbitrary shell commands, which can range from opening reverse shells, modifying critical system binaries, exfiltrating configuration data, or disabling logging and security controls.\nPost-exploitation impact includes complete administrative takeover of the VigorSwitch, enabling the adversary to manipulate VLAN configurations, intercept or mirror network traffic, pivot to adjacent network segments, or install persistent backdoors."
}