Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:18.490Z",
  "pubdate": "2026-08-24T18:17:18.490Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a stack-based buffer overflow vulnerability residing within the web management interface. Specifically, the flaw is localized to the webBackupAction function, where insufficient boundary checking during string manipulation operations leads to memory corruption. An authenticated remote attacker possessing valid administrative credentials can exploit this vulnerability by submitting specially crafted input parameters via the web management interface. Successful exploitation of this flaw can result in a complete denial of service of the affected networking device or potentially allow the execution of arbitrary commands within the context of the underlying operating system. The primary risk stems from the potential compromise of core network infrastructure equipment, threatening confidentiality, integrity, and availability. While exploitation mandates prior administrative authentication, the impact is severe, granting high-privileged control over the targeted routing and switching hardware.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow, stemming from insecure programming practices within the webBackupAction function of the DrayTek VigorSwitch web management daemon. The root cause of the flaw is the execution of repeated string concatenation operations targeting specific HTTP request parameters—namely pathN, valueN, key, and option—without performing adequate or total length validation prior to writing the data into fixed-size stack buffers. When an administrative user submits an HTTP request containing maliciously oversized values within these targeted fields, the underlying firmware copies the unbounded data past the physical boundaries of the allocated stack buffer. This results in the overwriting of adjacent stack memory, which can corrupt critical execution control data, such as saved frame pointers and return addresses, leading to application crashes or arbitrary code execution.\nThe attack flow proceeds as follows: First, the adversary authenticates to the DrayTek VigorSwitch web management interface using valid administrative credentials. Second, the attacker crafts a malicious HTTP request targeting the functionality governed by the webBackupAction function, injecting excessively long strings into the vulnerable pathN, valueN, key, or option input parameters. Third, the HTTP daemon parses the incoming request and passes the untrusted input directly into the vulnerable concatenation routines without verifying total length constraints. Fourth, the insecure copy operation overflows the fixed-size stack buffer, allowing the attacker to hijack the control flow of the binary if shellcode or a Return-Oriented Programming (ROP) chain is successfully mapped into memory. Finally, depending on the nature of the payload, the device either suffers an immediate denial of service due to an exception fault or executes attacker-supplied commands with the elevated privileges assigned to the web service.\nThe affected components comprise multiple DrayTek VigorSwitch models utilizing vulnerable firmware versions containing the flawed webBackupAction function. The vulnerability is exposed over the network via the administrative web management interface, typically accessible over HTTP or HTTPS. Exploitation requires network access to the management plane and valid administrative credentials, meaning internal attackers or compromised administrative accounts present the highest threat vector. Post-exploitation impact includes persistent denial of service, disruption of network traffic passing through the switch, and total administrative compromise of the underlying operating system, potentially enabling pivoting into adjacent internal network segments."
}