Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:08.643Z",
  "pubdate": "2026-08-24T18:17:08.643Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability residing within the administrative web management interface. Specifically, the vulnerability manifests in the setTime function due to the lack of adequate input validation and sanitization on authentication parameters, namely the username and password fields.\nA remote authenticated attacker possessing valid administrative credentials can leverage this flaw by supplying specially crafted input payloads designed to break out of the intended execution context and append arbitrary system commands.\nSuccessful exploitation of this vulnerability yields arbitrary code execution with root privileges on the underlying operating system of the affected network device. This grants the adversary complete administrative control over the switch, potentially facilitating lateral movement across the attached network infrastructure, traffic interception, or persistent compromise of network operations.\nThe primary exploitation requirement is prior acquisition of valid administrative credentials, limiting external unauthenticated attacks but presenting a severe risk via compromised accounts, insider threats, or credential stuffing vectors.",
  "technicalDetails": "The vulnerability is classified as an authenticated OS command injection flaw located within the administrative web management interface of multiple DrayTek VigorSwitch models. The vulnerable component is the setTime function, which handles system time synchronization and configuration.\nThe root cause of the vulnerability stems from insufficient input filtering, sanitization, and validation of user-supplied data accepted through the username and password fields during specific HTTP requests processed by the setTime function. When the application passes these unsanitized strings directly to underlying system APIs or shell execution routines, it fails to neutralize shell metacharacters.\nThe attack flow proceeds as follows: First, the remote adversary establishes an authenticated session against the web management interface of the DrayTek VigorSwitch using valid administrative credentials. Second, the attacker formulates an HTTP request targeted at the setTime function, embedding arbitrary command injection payloads within the username or password input parameters. Third, the backend application processes the request, concatenating the malicious input into a system command string without proper escaping.\nUpon execution, the underlying operating system interprets the injected metacharacters, executing the attacker-supplied commands with root privileges. Because the affected software runs with elevated permissions, the execution of arbitrary system binaries is immediate and unrestricted.\nThe post-exploitation impact includes full system compromise, capability to modify device configurations, installation of persistent backdoors, deployment of malicious firmware, and potential pivot points into internal network segments connected to the compromised DrayTek VigorSwitch."
}