Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:18.890Z",
  "pubdate": "2026-08-24T18:17:18.890Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical stack-based buffer overflow vulnerability residing within the poe_schedule_profile function. This security defect arises due to the insecure handling and repeated string concatenation of multiple configuration parameters—specifically start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration—into small, fixed-size destination buffers without enforcing strict input length validation or bounds checking.\nSuccessful exploitation of this vulnerability can lead to severe system instability, resulting in a permanent denial of service condition via device crashes, or potentially enabling remote code execution depending on the underlying memory architecture and compiler mitigations present in the firmware. The primary impact involves complete compromise of the affected network infrastructure device.\nTo successfully trigger and exploit this vulnerability, a remote attacker must authenticate against the device's web management interface, requiring valid administrative credentials. The attack surface is exposed via the administrative HTTP/HTTPS management protocols exposed by the affected network switches.",
  "technicalDetails": "The vulnerability is localized within the poe_schedule_profile function handling Power over Ethernet (PoE) schedule configurations on multiple DrayTek VigorSwitch models. The root cause of the vulnerability is classic improper input validation and unsafe memory management practices during string manipulation routines. Specifically, the firmware accepts multiple user-supplied HTTP request parameters—namely start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration—and concatenates them into statically allocated, fixed-size stack or heap buffers.\nBecause the underlying copy and concatenation routines fail to calculate or enforce length restrictions against the destination buffer capacity, an attacker supplying excessively long strings for any of these parameters forces a buffer overflow. This corrupts adjacent stack memory structures, including saved frame pointers and return addresses, or critical function pointers.\nThe attack flow proceeds as follows: First, the remote adversary authenticates to the DrayTek VigorSwitch web management interface utilizing valid administrative credentials. Second, the attacker crafts a malicious HTTP POST or GET request destined for the endpoint invoking the poe_schedule_profile function, embedding payload strings that significantly exceed the maximum expected byte length within the vulnerable parameters (start_date, start_time, duration_time, how_often, weekdays, monthly_date, or cycle_duration). Third, the web application backend parses the request and executes the unsafe concatenation logic without bounds checks, overflowing the fixed-size destination buffer with attacker-controlled data.\nDepending on the exact memory layout and exploitation technique, overwriting the saved return address alters the control flow of the application when the poe_schedule_profile function attempts to return. This results in either an immediate crash causing a denial of service (DoS) or redirection of execution flow to shellcode or Return-Oriented Programming (ROP) chains provided within the payload. The network exposure is limited to systems where the administrative web interface is accessible, though the severity remains high due to the requirement of administrative privileges and the potential for complete device takeover."
}