Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:17.697Z",
  "pubdate": "2026-08-24T18:17:17.697Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a remote command injection vulnerability residing within the tftp_upgrade function of the device firmware. This security flaw stems from the lack of adequate input sanitization and validation on the filename parameter prior to its execution in a system command string. Successful exploitation of this vulnerability allows an authenticated remote attacker to execute arbitrary system commands with root privileges directly on the underlying operating system of the target network device. The operational impact is severe, as it grants full administrative compromise of the affected switch, potentially enabling persistent unauthorized access, network traffic interception, and lateral movement across connected network segments. Exploitation prerequisites mandate that the threat actor possesses valid administrative credentials to successfully authenticate against the web management interface of the device before delivering the malicious payload. This requirement reduces the attack surface to authenticated users or scenarios where administrative credentials have been compromised, leaked, or left at default factory settings. Risk implications include complete loss of device integrity, potential bypass of network segmentation enforced by the switch, and the subversion of core networking functions.",
  "technicalDetails": "The vulnerability is localized within the tftp_upgrade function responsible for managing firmware and configuration updates over the Trivial File Transfer Protocol. The root cause of the flaw is improper input neutralization, specifically insufficient filtering and validation of the user-supplied filename field before it is insecurely concatenated into an internal command string executed by the system shell. When a request is processed by the vulnerable function, the raw or insufficiently sanitized filename parameter is appended directly to execution routines, enabling the injection of shell metacharacters or arbitrary command sequences.\nThe attack flow begins with the threat actor establishing network connectivity to the web management interface of the DrayTek VigorSwitch over supported protocols such as HTTP or HTTPS. The attacker must authenticate successfully by providing valid administrative credentials to gain access to the device management functions, including the firmware upgrade mechanisms. Once authenticated, the attacker initiates a crafted TFTP upgrade request via the web interface, substituting the filename parameter with a specially engineered payload containing malicious operating system commands appended to or disguised as a standard transfer filename.\nUpon receiving the malicious input, the tftp_upgrade function passes the unsanitized string into the underlying command execution sink without performing rigorous input validation or employing safe API functions like parameterized execution. The operating system shell interprets the injected metacharacters, leading to the execution of arbitrary commands. Because the affected web management services and underlying administrative daemons operate with elevated permissions, the injected payload executes with root privileges. This grants the attacker unrestricted control over the affected system, facilitating comprehensive post-exploitation activities such as installing backdoors, modifying device configurations, extracting sensitive system data, and leveraging the compromised switch as a pivot point to target other internal network assets."
}