Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:19.280Z",
  "pubdate": "2026-08-24T18:17:19.280Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical buffer overflow vulnerability residing within the acl_general_setup Add ACE function of the web management interface.\nThis security flaw is fundamentally caused by unsafe memory handling, specifically the unchecked copying of the user-supplied name field into a fixed-size internal buffer without proper length validation.\nA remote authenticated attacker possessing valid administrative credentials can exploit this weakness by submitting meticulously crafted input parameters to the vulnerable function.\nSuccessful exploitation of this vulnerability can result in a complete denial of service condition, disrupting network infrastructure operations, or potentially allow the execution of arbitrary commands within the underlying operating system.\nThe risk implications are severe due to the administrative access level required, as successful command execution could grant full control over the affected network switch, compromising adjacent network segments.\nMitigation strategies must focus on restricting administrative interface access, applying vendor-supplied firmware updates as soon as available, and monitoring management plane traffic for anomalous payload sizes indicative of exploitation attempts.",
  "technicalDetails": "The vulnerability is classified as a stack-based or heap-based buffer overflow occurring within the web management interface of multiple DrayTek VigorSwitch models.\nThe vulnerable component is explicitly identified as the acl_general_setup Add ACE function, which handles Access Control Entry configuration parameters parsed from incoming HTTP requests.\nThe root cause of the defect stems from the lack of strict boundary and length validation checks when processing the name field provided during the creation or modification of an Access Control Entry.\nWhen the application executes copy operations using vulnerable string manipulation routines, such as standard copying functions without explicit size constraints, the oversized input overflows the boundaries of the fixed-size destination buffer.\nExploitation requires network exposure to the device's web management interface, along with valid administrative credentials to successfully navigate to the configuration page and invoke the acl_general_setup Add ACE function.\nThe attack flow proceeds as follows: first, the authenticated attacker crafts a malicious HTTP POST or GET request containing a payload within the name parameter that substantially exceeds the allocated buffer size. Second, the web server daemon passes this crafted input to the acl_general_setup Add ACE function without sanitization or length truncation. Third, the function copies the excessive data into the fixed-size buffer, overwriting adjacent memory regions, saved return pointers, or critical control data structures.\nDepending on the overwritten memory layout, this memory corruption immediately destabilizes the firmware runtime environment, causing a fatal crash and subsequent denial of service.\nAlternatively, advanced payload construction may manipulate the instruction pointer to achieve arbitrary code execution under the privileges of the web management process, leading to potential persistent compromise and post-exploitation persistence within the network device."
}