Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:18.290Z",
  "pubdate": "2026-08-24T18:17:18.290Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical stack-based buffer overflow vulnerability residing within the pingtrace function of the web management interface. This security flaw stems from the inadequate validation of input lengths for the host, count, and interval parameters prior to memory copy operations.\nSuccessful exploitation of this vulnerability allows an authenticated remote attacker with administrative credentials to overwrite adjacent memory structures within the stack. This condition can be leveraged to cause a denial of service via application crash or potentially achieve arbitrary code execution on the underlying operating system.\nThe risk implication is severe, as compromise of network infrastructure devices like switches often grants attackers deep visibility into internal network traffic, facilitating lateral movement and man-in-the-middle attacks. Although remote exploitation is feasible over the network interface exposed by the management service, the prerequisite of valid administrative credentials limits the attack vector to authenticated users or compromised administrative sessions.",
  "technicalDetails": "The vulnerability is localized to the pingtrace function handling network diagnostic utilities within the firmware of affected DrayTek VigorSwitch models. The root cause of the security defect is a classic boundary violation caused by missing length checks during string concatenation and formatting operations. When a user submits input via the web management interface for the host, count, and interval fields, the application passes these parameters directly to a fixed-size internal buffer without validating whether the combined input size exceeds the allocated memory bounds.\nExploitation of this vulnerability requires the attacker to possess valid administrative credentials to access the device's web management interface. Once authenticated, the attacker crafts a malicious HTTP request containing excessively long payload strings targeted at the vulnerable pingtrace parameters. Upon receiving the crafted input, the binary concatenates the host, count, and interval values into the destination buffer on the stack. Because the input exceeds the predetermined buffer capacity, a stack-based buffer overflow occurs, corrupting adjacent stack frames, return pointers, or critical control data.\nThe attack flow proceeds as follows: First, the adversary authenticates to the web management interface using administrative credentials. Second, the adversary navigates to or directly invokes the pingtrace diagnostic utility endpoint, supplying a specially crafted HTTP POST or GET request where the host, count, or interval parameters contain payload data exceeding the bounds of the destination buffer. Third, the internal parsing and formatting routines copy the oversized input into the fixed-size stack buffer, triggering the overflow.\nDepending on the exact memory layout and CPU architecture, the payload behavior can result in an immediate segmentation fault and subsequent denial of service due to application crash, or the overwriting of return instruction pointers to redirect execution flow toward shellcode or Return-Oriented Programming chains. Post-exploitation impact includes full administrative compromise of the network switch, allowing the attacker to manipulate VLAN configurations, intercept traffic, disable security controls, or use the device as a pivot point for further internal network penetration."
}