Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:19.480Z",
  "pubdate": "2026-08-24T18:17:19.480Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models contain a critical stack-based buffer overflow vulnerability residing within the acl_general_setup Edit ACE function of the web management interface. This security flaw is triggered by the insecure handling of the name field, which is copied into a fixed-size internal memory buffer without performing adequate length validation or bounds checking. Successful exploitation of this vulnerability allows an authenticated remote attacker to corrupt adjacent memory regions, potentially leading to a persistent denial of service state by crashing the device firmware or facilitating arbitrary code execution under the privileges of the underlying web server process. Risk implications are severe, as unauthorized execution of arbitrary commands on network infrastructure devices can compromise entire network segments, facilitate lateral movement, and subvert routing or switching security controls. While the vulnerability is exposed over the network via the administrative web management interface, exploitation strictly requires the acquisition and utilization of valid administrative credentials, thereby restricting initial access to authorized users or attackers who have successfully compromised administrative authentication tokens. Mitigation efforts should focus on restricting administrative access, monitoring authentication logs, and applying vendor-supplied firmware updates as soon as they become available.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow rooted in the administrative web management subsystem of multiple DrayTek VigorSwitch models, specifically within the acl_general_setup function handling the editing of Access Control Entries (ACE). The root cause of the defect stems from the application utilizing unsafe string copy operations or memory manipulation routines that fail to validate the incoming length of the name field against the allocated dimensions of the destination buffer. When an administrator or an attacker with administrative credentials submits a crafted HTTP request containing an excessively long string within the vulnerable name parameter, the input overflows the fixed-size stack buffer, resulting in the corruption of adjacent stack memory, including saved frame pointers and return addresses.\nThe attack flow proceeds as follows: First, the attacker must authenticate to the web management interface using valid administrative credentials, satisfying the mandatory authentication requirements enforced by the device. Second, the attacker navigates to or directly sends a maliciously crafted HTTP POST or GET request targeted at the acl_general_setup Edit ACE function. This request injects a specially crafted payload into the name input field, designed to exceed the predetermined length of the underlying buffer. Third, upon processing the input, the vulnerable function blindly copies the oversized payload into memory without boundary enforcement, overwriting critical control data on the stack. Finally, when the function attempts to return execution flow, the corrupted return address points to attacker-controlled memory or causes a segmentation fault, culminating in either arbitrary command execution or an immediate denial of service due to a firmware crash.\nThe affected component is the web management daemon responsible for parsing and applying Access Control List (ACL) configurations. The network exposure is remote relative to the management interface, typically accessible via HTTP or HTTPS over the local management network or WAN if improperly configured. Privilege requirements mandate full administrative access, and payload behavior can range from abrupt device termination to the execution of arbitrary shell commands or binaries, leading to complete system compromise and post-exploitation persistence on the affected network switch."
}