Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:19.083Z",
  "pubdate": "2026-08-24T18:17:19.083Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical stack-based buffer overflow vulnerability residing within the switch_lan_gvrp function. This security defect arises due to the unsafe processing and copying of the portList field into an insufficiently sized internal memory buffer without adequate bounds checking.\nSuccessful exploitation of this vulnerability can lead to a complete denial of service condition, disrupting network availability, or potentially allow the execution of arbitrary commands under the privileges of the underlying firmware process. The impact is severe, as it undermines the integrity and availability of core networking hardware.\nThe affected systems comprise multiple DrayTek VigorSwitch models utilizing vulnerable firmware versions containing the flawed switch_lan_gvrp implementation. Risk implications include unauthorized system compromise, firmware instability, and potential lateral movement or persistent control over the network infrastructure device.\nExploitation of this vulnerability requires valid administrative credentials to access the device's web management interface, indicating that the threat actor must either compromise administrative accounts or originate from a trusted internal source. The attack vector is remotely exploitable via crafted input delivered through the administrative web interface targeting the GVRP configuration handling logic.",
  "technicalDetails": "The vulnerability is fundamentally rooted in a classic buffer overflow flaw located in the switch_lan_gvrp function of the DrayTek VigorSwitch firmware. The root cause is the absence of rigorous length validation and bounds checking when copying user-supplied input from the portList field into a static or undersized destination buffer in memory.\nThe vulnerable component is the administrative web management interface handling routines specifically responsible for Generic VLAN Registration Protocol (GVRP) configurations. Because the input vector processes parameters parsed from HTTP requests submitted by users interacting with the web interface, it is exposed over the network via the device management protocols.\nNetwork exposure is defined by the accessibility of the switch's web management interface, which is typically exposed on internal management networks or, if misconfigured, directly to the wider internet. Authentication requirements dictate that the attacker must possess valid administrative credentials to successfully authenticate to the web management interface before the vulnerable function can be invoked.\nThe attack flow proceeds in a sequential manner. First, an authenticated threat actor crafts a malicious HTTP request targeting the GVRP configuration functionality, specifically embedding an oversized payload within the portList field. Second, the web management daemon passes this crafted input to the vulnerable switch_lan_gvrp function. Third, the function executes an unsafe memory copy operation, such as strcpy or an unconstrained memcpy equivalent, transferring the oversized portList data into the undersized stack buffer.\nAs the payload exceeds the allocated boundaries of the target buffer, adjacent memory regions on the stack are systematically overwritten. This memory corruption can overwrite saved frame pointers and return addresses. Depending on the exact payload and memory layout, this leads immediately to an application crash and denial of service. Alternatively, by carefully structuring the injected shellcode or control-flow hijacking data within the overflow payload, a sophisticated attacker can achieve arbitrary command execution.\nPost-exploitation impact includes full administrative takeover of the affected DrayTek VigorSwitch. Since network switches operate at critical layers of enterprise network architecture, successful code execution can allow the adversary to manipulate VLAN configurations, intercept or mirror network traffic, pivot deeper into internal network segments, or establish persistent firmware-level compromise."
}