Description

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-24T18:17:06.847Z",
  "pubdate": "2026-08-24T18:17:06.847Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a null pointer dereference vulnerability residing within the formlogout function of the web management interface. This security flaw stems from the absence of rigorous validation checks for an empty or completely absent Cookie header prior to executing internal string manipulation routines. A remote attacker possessing valid administrative credentials can successfully exploit this condition by transmitting a specially crafted HTTP request targeting the affected endpoint. Successful exploitation of this vulnerability directly precipitates an abnormal termination of the target service, resulting in a persistent Denial of Service (DoS) state that disrupts administrative accessibility and network management capabilities on the impacted device. Given the requirement for high-privilege access, the primary risk involves targeted service disruption by malicious insiders or compromised administrative accounts.",
  "technicalDetails": "The vulnerability is localized to the web management daemon handling administrative functions on multiple DrayTek VigorSwitch models, specifically within the formlogout function responsible for terminating authenticated sessions. The root cause of the flaw is categorized as a null pointer dereference, originating from inadequate input validation and missing error-handling logic regarding HTTP request headers. Specifically, the application attempts to perform string handling operations on the Cookie header without first verifying whether the header is present, null, or empty in the incoming HTTP request context.\nThe attack flow proceeds as follows: First, an authenticated remote attacker crafts a malicious HTTP request directed at the web management interface, omitting or nullifying the Cookie header that typically contains active session identifiers. Second, the web server routes this malformed request to the vulnerable formlogout function for processing. Third, the function executes string parsing or extraction routines expecting a valid pointer to cookie data. Fourth, because the expected header data is absent, the pointer resolves to a null memory address. Fifth, the application attempts to dereference this null pointer during string handling operations, triggering a segmentation fault or memory access violation.\nThis unhandled exception forces the immediate crash and termination of the web management service daemon. Because the vulnerability requires valid administrative credentials to interact with the authenticated logout endpoint, the attacker must first authenticate to the device's web management interface. The network exposure is limited to the administrative interface, typically accessible via HTTP or HTTPS over the local network or designated management VLANs. The post-exploitation impact is strictly confined to a Denial of Service condition, rendering the web management interface unresponsive and requiring manual intervention, such as a device reboot, to restore service availability."
}