Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:07.497Z",
  "pubdate": "2026-08-24T18:17:07.497Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability residing within the authentication handling functionality. This security flaw is classified as an input validation failure leading to remote command execution. The vulnerability impacts the administrative web management interface of the affected DrayTek VigorSwitch devices, potentially exposing enterprise network infrastructure to full system compromise.\nSuccessful exploitation of this flaw allows an authenticated remote attacker to execute arbitrary system commands with root privileges directly on the underlying operating system of the target network switch. The primary risk implication involves total loss of device integrity, enabling malicious actors to manipulate network traffic, intercept sensitive data, or pivot deeper into the internal network topology.\nPrerequisites for exploitation require the attacker to possess valid administrative credentials to access the device's web management interface. While authentication is required, the presence of this vulnerability undermines the trust boundary of the administrative plane, transforming legitimate management interactions into a vector for remote code execution.",
  "technicalDetails": "The vulnerability originates within the auth_set function responsible for processing authentication routines on vulnerable DrayTek VigorSwitch models. The fundamental root cause is the insufficient input validation, sanitization, and filtering applied to parameters processed by the application prior to their inclusion in backend system execution routines.\nSpecifically, the username and password fields accepted by the web management interface are inadequately filtered. When a user submits authentication credentials, the application insecurely passes these user-supplied strings into command execution sinks. This improper handling allows an attacker to inject shell metacharacters or command separators into the input streams of the vulnerable auth_set function.\nThe attack flow proceeds as follows: First, the adversary establishes an authenticated session or leverages pre-acquired valid administrative credentials to interact with the device's web management interface. Second, the attacker crafts a malicious HTTP request targeting the authentication mechanism, embedding arbitrary shell commands within the username or password parameters. Third, the web application passes these unsanitized parameters directly to the underlying operating system shell during the execution of the auth_set function.\nBecause the web management services operate with elevated privileges, the injected commands are executed with root privileges. This grants the attacker unrestricted administrative control over the switch operating system. Post-exploitation impact includes the modification of system configurations, persistence installation, firmware tampering, and unauthorized manipulation of switching and routing functions across the network environment."
}