Description

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T18:17:07.060Z",
  "pubdate": "2026-08-24T18:17:07.060Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a pre-authentication command injection vulnerability residing within the setget.cgi interface.\nThe security flaw stems from inadequate input validation and insufficient sanitization of the pass field before it is processed and passed to the underlying operating system for execution.\nA remote, unauthenticated attacker can exploit this weakness by submitting specifically crafted input payloads to the vulnerable interface.\nSuccessful exploitation of this vulnerability allows the adversary to achieve arbitrary command execution directly on the targeted device.\nBecause the affected services run with elevated privileges, the execution of arbitrary commands results in full root privilege compromise of the underlying system.\nThis introduces severe risk implications, potentially enabling complete administrative takeover, interception of network traffic, lateral movement within the connected local area network, and persistence mechanisms established by malicious actors.\nNo specific version numbers or external exploitation requirements beyond network reachability to the vulnerable endpoint are detailed, though the attack operates strictly without requiring prior authentication credentials.",
  "technicalDetails": "The vulnerability is classified as a pre-authentication command injection, specifically manifesting in the setget.cgi interface of multiple DrayTek VigorSwitch models.\nThe root cause of the vulnerability lies in the improper handling and insufficient filtering of user-supplied data provided through the pass parameter.\nWhen the setget.cgi component processes incoming HTTP requests, the value assigned to the pass field is passed insecurely to the underlying operating system shell or system execution functions without proper sanitization or neutralization of command separator characters.\nThe attack vector is network-based and exposed remotely.\nBecause the vulnerability is pre-authentication, attackers do not need to supply valid administrative credentials or interact with a login mechanism to reach the vulnerable code path.\nThe execution context of the vulnerable component operates with root privileges, meaning any injected shell commands are executed with the highest level of system authorization.\nThe step-by-step attack flow begins when an unauthenticated remote attacker crafts an HTTP request targeting the setget.cgi endpoint on the target DrayTek VigorSwitch.\nThe attacker appends malicious shell metacharacters and arbitrary system commands directly into the vulnerable pass field within the request parameters.\nUpon receiving the request, the DrayTek VigorSwitch parses the input via the setget.cgi component.\nDue to insufficient filtering mechanisms, the application concatenates or passes the unsanitized string directly into a system command execution context.\nThe underlying operating system interprets the injected metacharacters, breaking out of the intended application logic and executing the attacker's payload alongside or instead of the expected system routine.\nThis payload behavior immediately yields arbitrary command execution with root privileges, granting the attacker total control over the affected device.\nPost-exploitation impact includes complete system compromise, firmware manipulation, configuration tampering, traffic sniffing, and potential use of the compromised switch as a pivoting point to attack other internal network segments."
}