Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:07.813Z",
  "pubdate": "2026-08-24T18:17:07.813Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability located within the web management interface. Specifically, the flaw resides in the handling of administrative inputs within the getDetail function.\nThe root cause stems from insufficient input sanitization and filtering applied to the username and password fields prior to passing these parameters into underlying system command execution routines.\nSuccessful exploitation of this security defect allows a remote authenticated attacker to execute arbitrary system commands with ultimate privileges on the underlying operating system.\nAlthough the attack requires valid administrative credentials to access the vulnerable web management functionality, the severity of the resulting impact is catastrophic due to the acquisition of root-level control over the network device.\nRisk implications include full device compromise, potential lateral movement into connected internal network segments, interception of administrative sessions, manipulation of network traffic configurations, and persistent unauthorized access.\nThis vulnerability compromises the integrity, availability, and confidentiality of the affected DrayTek VigorSwitch deployments, necessitating immediate defensive intervention and access restriction.",
  "technicalDetails": "The vulnerability is classified as an authenticated command injection flaw affecting multiple DrayTek VigorSwitch models. The vulnerable software component is identified as the getDetail function within the device firmware's web management interface.\nThe core architectural defect involves inadequate validation, sanitization, and contextual escaping of parameters derived from the username and password HTTP input fields. When processing authentication requests or related routine parameter evaluations, the getDetail function improperly incorporates these untrusted user-supplied strings directly into system-level command execution interfaces without adequate constraint enforcement.\nExploitation of this vulnerability requires network exposure to the web management interface and necessitates that the remote attacker possesses valid administrative credentials. Consequently, an external attacker must either compromise administrative credentials beforehand or perform credential-based authentication prior to executing the attack vector.\nThe step-by-step attack flow initiates when the authenticated adversary crafts malicious HTTP requests targeted at the web management service, embedding shell metacharacters or command separators within the username or password parameters destined for the getDetail function.\nUpon receipt, the vulnerable backend handler processes the HTTP request and forwards the unsanitized payload directly to the underlying operating system shell execution mechanism.\nDue to the lack of input filtering, the injected command syntax is interpreted and executed by the system shell with root privileges.\nThe behavior of the payload results in immediate arbitrary code execution under the security context of the root user. This grants the attacker full administrative control over the underlying Linux-based operating system of the DrayTek VigorSwitch.\nPost-exploitation impact encompasses total device takeover, modification of firmware behavior, installation of persistent backdoors, deployment of malicious packet capture tools, disruption of network routing and switching protocols, and the facilitation of further exploitation vectors targeting the internal network infrastructure."
}