Description

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T18:17:07.280Z",
  "pubdate": "2026-08-24T18:17:07.280Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a pre-authentication null pointer dereference vulnerability residing within the setget.cgi interface. This security flaw stems from a critical lack of input validation and absence checking when the pass field is omitted from incoming HTTP requests. The resulting impact is a complete denial of service condition, as unauthorized remote attackers can trigger application crashes by submitting crafted requests to the vulnerable endpoint.\nThe risk implications are severe for enterprise and operational environments relying on these network switches, as an unauthenticated external threat actor can repeatedly disrupt critical networking infrastructure without prior system access or valid credentials. Exploitation requires network reachability to the administrative or management interface hosting the setget.cgi binary, alongside the ability to craft HTTP requests that deliberately omit authentication parameters.\nGiven the pre-authentication nature of the flaw, no privileged access is necessary to initiate the denial of service attack vector. Remediation efforts must focus on applying vendor-supplied firmware updates as soon as they become available, while enforcing strict network segmentation and perimeter access controls to limit exposure of the switch management plane to trusted administrative networks only.",
  "technicalDetails": "The vulnerability is classified as a null pointer dereference, occurring within the setget.cgi interface handling mechanism across multiple DrayTek VigorSwitch models. The root cause of this software defect is the failure of the binary to properly validate and handle missing parameter fields during HTTP request parsing, specifically when the expected pass field is entirely absent from the input data structure.\nThe vulnerable component resides in the web management application logic responsible for processing configuration and status queries via the setget.cgi script. When a remote client submits an HTTP request to this endpoint that lacks the mandatory authentication password parameter, the parsing routine attempts to dereference a memory pointer associated with the missing field without performing a prior null check. This memory access violation immediately triggers a segmentation fault or unhandled exception within the underlying process.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker establishes network connectivity to the targeted DrayTek VigorSwitch management interface. Second, the attacker constructs a specially crafted HTTP request targeting the setget.cgi interface while intentionally omitting the pass field. Third, upon receipt and subsequent parsing of the malformed request by the vulnerable binary, the application attempts to read or write to an uninitialized or null memory address. Finally, the resulting exception crashes the service, rendering the management interface unavailable and causing a denial of service condition for the affected device.\nAuthentication requirements are entirely absent, as the vulnerability is pre-authentication and can be triggered prior to establishing a valid session. Privilege requirements are nonexistent, allowing any network-adjacent or remote attacker with access to the management service to initiate the exploit. Network exposure is tied directly to the accessibility of the switch management interface, which may be exposed locally or improperly exposed to wide-area networks. Payload behavior is strictly destructive to process stability, causing immediate termination of the target service rather than facilitating arbitrary code execution or post-exploitation persistence. Remediation requires updating the affected firmware to a version that properly implements input validation and null pointer checks for all expected CGI parameters."
}