Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:07.977Z",
  "pubdate": "2026-08-24T18:17:07.977Z",
  "executiveSummary": "A command injection vulnerability has been identified in multiple DrayTek VigorSwitch models. The security flaw resides within the setDevice function and is caused by the failure to adequately sanitize user-supplied input across specific administrative fields before executing underlying system commands.\nSuccessfully exploiting this vulnerability enables a remote threat actor to achieve arbitrary command execution with root privileges on the affected hardware. The primary impact of this flaw includes complete compromise of the underlying operating system, unauthorized administrative manipulation of network infrastructure, and potential lateral movement across connected network segments.\nThe affected systems comprise multiple DrayTek VigorSwitch models utilizing the vulnerable web management interface implementation. The overall risk implication is critical due to the elevated execution context and the potential for full device takeover.\nPrerequisites for successful exploitation require the attacker to possess valid administrative credentials to access the device's web management interface. With these credentials, the attacker can supply crafted payloads within specific input fields to trigger the command injection vector.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the setDevice function of the affected DrayTek VigorSwitch firmware. The root cause of the issue stems from insufficient input validation and sanitization of parameters accepted via the web management interface. Specifically, the username, password, and location fields process incoming user data without properly stripping or escaping shell metacharacters before passing the strings to the underlying operating system shell for execution.\nThe vulnerable component is the web management interface handling the device configuration logic through the setDevice function. Network exposure is present via the administrative web services running on the targeted VigorSwitch devices, typically accessible over HTTP or HTTPS across the local or wide area network depending on device configuration and hardening practices.\nAuthentication requirements dictate that an attacker must first obtain or brute-force valid administrative credentials to interact with the web management interface and access the vulnerable setDevice functionality. Privilege requirements are inherently satisfied post-authentication, as the application executes the underlying system commands with root privileges.\nThe attack flow proceeds as follows: First, the attacker establishes network connectivity to the web management interface of the target DrayTek VigorSwitch model. Second, the attacker authenticates using valid administrative credentials to gain access to the device management parameters. Third, the attacker submits a crafted HTTP request containing malicious shell metacharacters injected into the username, password, or location fields of the setDevice function.\nUpon receiving the request, the application passes the unsanitized input directly to the system shell. The payload behavior results in the execution of arbitrary commands injected by the attacker. Because the web management daemon or underlying execution context operates with root privileges, the injected commands inherit the highest level of system access.\nThe post-exploitation impact includes full root-level control over the DrayTek VigorSwitch. An attacker can modify device configurations, intercept network traffic, install persistent backdoors, disrupt network operations, or pivot into other internal network segments accessible from the compromised switch infrastructure."
}