Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:18.693Z",
  "pubdate": "2026-08-24T18:17:18.693Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical stack-based buffer overflow vulnerability located within the internal sysreboot function.\nThe security defect stems from the unsafe concatenation and parsing of split valueN input parameters directly into a static, fixed-size memory buffer without proper boundary validation.\nSuccessful exploitation of this vulnerability allows an authenticated remote attacker with administrative privileges over the web management interface to trigger a complete denial of service condition by crashing the target device, or potentially achieve arbitrary command execution within the underlying operating system context.\nAlthough the vulnerability requires prior authentication, the presence of administrative access over the network exposes enterprise network infrastructure to high-severity remote attacks.\nThe risk implications include unauthorized disruption of critical networking hardware and potential full administrative compromise of affected switch appliances if shell execution payloads can be successfully crafted and injected via the vulnerable function.",
  "technicalDetails": "The root cause of the vulnerability resides in memory management deficiencies within the sysreboot function of the affected DrayTek VigorSwitch firmware.\nSpecifically, the vulnerability is triggered when the application processes incoming HTTP requests containing crafted input parameters, specifically splitting and concatenating valueN data strings.\nBecause the function fails to perform adequate length checks or input validation before copying these split strings into a static, fixed-size stack buffer, a classic buffer overflow condition occurs.\nThe attack flow requires the adversary to first authenticate to the web management interface using valid administrative credentials.\nOnce authenticated, the attacker submits a specially crafted HTTP request containing an oversized malicious payload targeted at the sysreboot parameter handling mechanism.\nAs the application processes the input, the unchecked concatenation overflows the bounds of the destination buffer, overwriting adjacent stack memory structures, including saved frame pointers and return addresses.\nDepending on the exact memory layout and absence of modern exploit mitigations such as stack canaries or address space layout randomization, this memory corruption either leads to an immediate application crash and denial of service due to a segmentation fault, or allows the redirection of execution flow to arbitrary code supplied in the payload.\nThe vulnerable component is exposed via the device network management interface, affecting multiple DrayTek VigorSwitch models that share this vulnerable codebase.\nPrivilege requirements mandate valid administrative credentials, limiting the attack vector to authenticated sessions, yet representing a severe risk from insider threats or compromised administrative accounts."
}