Description

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-24T18:17:17.893Z",
  "pubdate": "2026-08-24T18:17:17.893Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a directory traversal vulnerability that compromises the underlying file system security of the affected devices. This vulnerability stems from insufficient input validation within the administrative web management interface.\nSpecifically, the flaw resides in the getSyslogFile function, where the option field fails to properly sanitize user-supplied input. By leveraging path traversal sequences, an authenticated remote attacker can manipulate file retrieval parameters to access arbitrary system files residing outside the intended directory scope.\nThe primary impact of this vulnerability involves unauthorized information disclosure, potentially exposing sensitive system data, configurations, or logs that could facilitate further compromise of the network infrastructure.\nAlthough exploitation requires valid administrative credentials, thereby limiting unauthenticated external access, the risk implications remain significant due to the elevated privileges typically associated with administrative sessions on networking hardware. Mitigation relies upon applying vendor-supplied firmware updates as they become available and enforcing strict access controls to the web management interface.",
  "technicalDetails": "The vulnerability is classified as a directory traversal flaw affecting multiple DrayTek VigorSwitch models. The vulnerable component is the getSyslogFile function exposed within the device's web management interface.\nThe root cause of the vulnerability is the lack of robust input validation and path sanitization on the option field processed by the getSyslogFile function. When handling requests directed at this function, the application directly incorporates user-supplied parameters into file retrieval operations without adequately stripping relative path identifiers such as dot-dot-slash sequences.\nExploitation of this vulnerability requires network exposure to the device's web management interface and necessitates valid administrative credentials. An attacker must first authenticate successfully to the web interface to interact with the administrative functions containing the flaw.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated session with the DrayTek VigorSwitch web management interface using administrative credentials. Second, the attacker crafts a malicious HTTP request targeting the getSyslogFile function. Within this request, the attacker injects path traversal sequences (such as relative directory navigation strings) into the vulnerable option field.\nUpon receiving the crafted input, the vulnerable getSyslogFile function fails to validate or restrict the file path, interpreting the traversal sequences and allowing access to the file system outside of the designated logging directory. The device subsequently reads the targeted arbitrary file and returns its contents to the attacker within the HTTP response.\nThe post-exploitation impact includes the unauthorized disclosure of sensitive files accessible by the underlying operating system user, which may compromise device confidentiality and provide reconnaissance data useful for advanced persistent threats against the local network environment."
}