Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:06.610Z",
  "pubdate": "2026-08-24T18:17:06.610Z",
  "executiveSummary": "A command injection vulnerability has been identified within multiple DrayTek VigorSwitch models. The security flaw specifically resides in the sysreboot function of the device firmware.\nThe root cause of the vulnerability stems from the insufficient sanitization and filtering of user-supplied input across multiple parameters, namely config, act, pathN, and valueN, prior to being passed into system command execution routines.\nSuccessful exploitation of this vulnerability allows a remote attacker to execute arbitrary system commands directly on the underlying operating system.\nBecause the affected administrative binaries execute with elevated privileges, a successful compromise results in arbitrary code execution with root privileges, granting the adversary complete control over the compromised network device.\nAlthough the attack vector is accessible remotely via the device's web management interface, exploitation strictly requires the acquisition and utilization of valid administrative credentials.\nThis introduces significant risk to organizational network infrastructure, as a compromised core or distribution switch can be leveraged by malicious actors to facilitate lateral movement, man-in-the-middle attacks, traffic manipulation, or persistent unauthorized access within the local network topology.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw affecting multiple DrayTek VigorSwitch models. The vulnerable component is the sysreboot function handling administrative configuration and reboot operations within the web management interface.\nThe root cause of the vulnerability is the lack of proper input validation, sanitization, and contextual escaping. Specifically, parameters including config, act, pathN, and valueN are accepted via HTTP requests and subsequently concatenated or passed directly into underlying system shell execution functions without adequate neutralization of shell metacharacters.\nThe attack vector is network-based, targeting the web management interface exposed by the device via standard web protocols such as HTTP or HTTPS. However, exploitation mandates that the remote attacker possesses valid administrative credentials to authenticate to the management interface before supplying the malicious payload.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the DrayTek VigorSwitch web management interface using valid administrative credentials. Second, the attacker constructs a crafted HTTP request targeting the sysreboot function, embedding malicious shell metacharacters and arbitrary commands within the vulnerable parameters (config, act, pathN, or valueN). Third, the web application processes the request and hands the unsanitized input to the underlying operating system execution environment. Fourth, the system interprets and executes the injected command string alongside or in place of the intended administrative routine.\nThe payload behavior involves the direct execution of operating system commands spawned from the web service daemon process. Due to the insecure design of the application binaries, these processes execute with root privileges.\nThe post-exploitation impact of this vulnerability is severe. With root-level access, an attacker can modify system binaries, install persistent backdoors, extract sensitive configuration data including plaintext or hashed credentials, manipulate VLAN configurations, intercept network traffic traversing the switch, or utilize the compromised network device as a pivot point to attack other internal hosts and segments within the network architecture."
}