Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:08.480Z",
  "pubdate": "2026-08-24T18:17:08.480Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability residing within the web management interface. Specifically, the flaw is triggered through the setDevProto function due to inadequate input sanitization and filtering applied to administrative parameters, namely the username and password fields.\nA remote authenticated attacker possessing valid administrative credentials can exploit this security defect by supplying maliciously crafted input strings. Successful exploitation leads to arbitrary command execution directly on the underlying operating system with root privileges, yielding total device compromise.\nThe risk implications are severe, as an adversary who has obtained or compromised administrative credentials can completely subvert the integrity, confidentiality, and availability of the affected networking hardware. This enables attackers to establish persistent access, pivot deeper into connected internal network segments, intercept or manipulate transit traffic, and disrupt critical network infrastructure services.\nWhile exploitation requires prior authentication to the administrative web management interface, the capability to execute arbitrary OS commands as root represents a critical failure in input validation and parameter handling within the device firmware.",
  "technicalDetails": "The vulnerability is a classic command injection flaw located in the setDevProto function of the device firmware utilized by multiple DrayTek VigorSwitch models. The root cause stems from the insecure handling of user-supplied data within the administrative web management interface, where parameters corresponding to the username and password fields are passed directly to system-level execution routines without sufficient input filtering, validation, or escaping.\nThe vulnerable component is the backend processing logic tied to the setDevProto function. When administrative credentials or configuration parameters are submitted via the web interface, the application constructs system commands incorporating the raw values of the username and/or password fields. Because these fields fail to properly sanitize shell metacharacters or command separators, an attacker can inject arbitrary shell commands directly into the input vectors.\nThe attack flow proceeds as follows: First, the remote attacker authenticates to the DrayTek VigorSwitch web management interface using valid administrative credentials. Second, the attacker navigates to or generates an HTTP request destined for the setDevProto function, injecting specially crafted shell command payloads within the username or password parameters. Third, upon receiving the request, the underlying firmware processes the parameters and invokes a system execution function, causing the embedded operating system to parse and execute the attacker-supplied shell commands alongside or in place of the intended operations.\nBecause the affected firmware executes these backend processes with elevated system privileges, the injected payload executes with root privileges. This grants the attacker complete control over the DrayTek VigorSwitch operating environment. Post-exploitation impact includes the ability to modify system configurations, extract sensitive information such as stored credentials and cryptographic keys, deploy persistent backdoors, launch secondary attacks against internal hosts, or render the networking device inoperable."
}