Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:08.140Z",
  "pubdate": "2026-08-24T18:17:08.140Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability located within the rebDevice function of the web management interface. This security flaw stems from insufficient input sanitization and validation of the username and password fields prior to passing them into a command execution context. Successful exploitation of this vulnerability allows a remote adversary to execute arbitrary system commands with root privileges directly on the underlying operating system.\nThe risk implications are severe, as full administrative compromise of the affected network switches can lead to network traffic interception, man-in-the-middle attacks, lateral movement across connected network segments, and persistent device destabilization. Although exploitation yields complete control over the routing and switching hardware, a mandatory prerequisite for an attacker is the prior acquisition of valid administrative credentials to access the device's web management interface.\nThe affected systems are constrained to multiple DrayTek VigorSwitch models integrating the vulnerable rebDevice function within their firmware. Organizations utilizing these network devices face significant exposure if management interfaces are unnecessarily exposed to untrusted networks or the wider internet. Remediation efforts must focus on applying vendor-supplied firmware updates, restricting management plane access, and enforcing strict credential management policies.",
  "technicalDetails": "The vulnerability resides in the rebDevice function handling administrative actions within the web management interface of multiple DrayTek VigorSwitch models. The root cause of the flaw is the lack of proper input validation, sanitization, and contextual escaping applied to user-supplied parameters, specifically within the username and password input fields. When these fields are processed by the application backend, unsanitized input is concatenated or passed directly into system-level execution routines, facilitating OS command injection.\nThe attack vector is network-based, targeting the web management interface of the affected switches over protocols utilized for administrative access, such as HTTP or HTTPS. The attack flow proceeds in a sequential manner. First, the attacker establishes network connectivity to the target device's web management interface. Second, the attacker supplies valid administrative credentials to authenticate successfully, satisfying the prerequisite authentication requirement. Third, the attacker crafts a malicious payload containing shell metacharacters or command separators (such as semicolons, pipe symbols, or backticks) embedded within the authentication or rebDevice parameter fields.\nUpon receiving the crafted input, the vulnerable rebDevice function improperly processes the payload and forwards the tainted data to the underlying operating system shell without adequate filtering. The system executes the concatenated arbitrary commands with root privileges, which represent the highest privilege level available on the device. Because the commands execute in the context of the root user, the payload behavior is unbounded by standard permission checks, enabling complete system compromise.\nThe post-exploitation impact includes full system takeover, modification of system configurations, installation of persistent backdoors, firmware tampering, and potential pivoting into internal networks connected to the compromised switch. The vulnerability requires administrative authentication, indicating that insider threats, compromised administrative credentials, or chained vulnerabilities allowing credential disclosure can serve as precursors to successful exploitation. Network exposure is typically mitigated if the web management interface is isolated from external networks, though internal exposure remains a persistent vector."
}