Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:07.653Z",
  "pubdate": "2026-08-24T18:17:07.653Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical remote command injection vulnerability residing within the administrative web management interface. Specifically, the flaw affects the internal getVid function, which fails to adequately sanitize and validate user-supplied parameters.\nThe primary impact of this vulnerability is complete system compromise. An adversary who successfully exploits this flaw can achieve arbitrary command execution operating with root-level privileges, thereby undermining the confidentiality, integrity, and availability of the affected networking equipment.\nThe affected systems encompass multiple DrayTek VigorSwitch models utilizing the vulnerable firmware codebase containing the insecure getVid handler. The risk implications are severe, as routers and switches serve as core network infrastructure components, and their compromise can facilitate lateral movement, traffic interception, and persistent unauthorized access across the underlying network topology.\nRegarding attacker capabilities and exploitation requirements, the vulnerability demands valid administrative credentials to access the web management interface. Once authenticated, an attacker can supply specially crafted malicious payloads injected into the vulnerable username and password fields. These inputs are subsequently processed by the underlying system shell without proper sanitization, triggering arbitrary execution under the highest privilege tier.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and improper neutralization of special characters within the username and password parameters processed by the getVid function. When authentication requests or related administrative functions are handled, the application improperly passes these input strings directly into system-level command execution sinks.\nThe vulnerable component is identified as the getVid function within the web management interface binaries of the DrayTek VigorSwitch firmware. Because the function handles authentication or session-related parameters without employing rigorous allowlisting or proper argument escaping, command separators or shell metacharacters embedded within the input strings are interpreted directly by the underlying operating system shell.\nThe attack vector requires network exposure to the device's administrative web management interface, typically accessible via HTTP or HTTPS protocols. Exploitation prerequisites mandate that the attacker possesses valid administrative credentials to authenticate against the web interface successfully. Consequently, unauthenticated threat actors cannot directly trigger the vulnerability unless prior credential compromise or a separate authentication bypass flaw has been leveraged.\nThe step-by-step attack flow proceeds as follows: First, the remote attacker establishes a network connection to the DrayTek VigorSwitch web management interface. Second, the attacker authenticates using valid administrative credentials to establish a legitimate management session or interacts directly with the authentication endpoints. Third, the attacker crafts a malicious HTTP request containing specially engineered shell commands embedded within the username or password fields destined for the getVid function. Fourth, the server-side application receives the crafted parameters and passes them insecurely to the underlying shell execution environment without prior neutralization. Fifth, the operating system parses the injected metacharacters, executing the arbitrary attacker-supplied commands with root privileges.\nThe payload behavior involves the immediate execution of arbitrary system commands under the security context of the root user. Post-exploitation impact includes full administrative control over the DrayTek VigorSwitch device, enabling the adversary to modify network configurations, deploy persistent backdoors, capture sensitive traffic, manipulate VLAN settings, or utilize the compromised switch as a pivoting point to target other internal network segments."
}