Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:19.680Z",
  "pubdate": "2026-08-24T18:17:19.680Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability residing within the diag_logmail function of the device's firmware. This security flaw is classified as a classic stack-based or heap-based buffer overflow resulting from unsafe string concatenation practices. The primary business and operational impact includes potential denial of service conditions and the severe risk of arbitrary command execution on the underlying operating system of the affected network switches.\nThe vulnerability affects multiple DrayTek VigorSwitch models that process email log configurations. Risk implications are elevated due to the capability of an authenticated remote attacker to achieve system compromise or service disruption. Exploitation of this vulnerability requires valid administrative credentials to access the device's web management interface, meaning the attack vector is limited to malicious actors who have already compromised administrative accounts or insiders with legitimate management access.",
  "technicalDetails": "The vulnerability is caused by insecure memory handling within the diag_logmail function implemented in the firmware of multiple DrayTek VigorSwitch models. Specifically, the vulnerable component fails to perform adequate bounds checking when processing and concatenating multiple smtpReceiver email addresses. During the log mail configuration or execution routine, the application takes user-supplied email address inputs and concatenates them sequentially into a fixed-size internal memory buffer. Because the implementation lacks explicit length validation or safe string termination functions such as snprintf, supplying an excessive number of inputs or overly long crafted strings exceeds the allocated boundaries of the target buffer.\nThe attack flow requires an authenticated remote attacker to interact with the device's web management interface. First, the attacker must authenticate using valid administrative credentials. Once access is established, the attacker navigates to the relevant configuration or diagnostic section and supplies specially crafted input containing excessively long or multiple smtpReceiver email addresses. When the diag_logmail function processes this malicious payload, the unsafe concatenation overwrites adjacent memory regions on the stack or heap. Depending on the memory layout and architecture, this overwriting corrupts critical control data, function pointers, or local variables.\nThe resulting impact of this memory corruption leads directly to a denial of service through application crashes or kernel panics, or potentially allows the execution of arbitrary shell commands if the instruction pointer is successfully hijacked via shellcode injection. Network exposure is tied to the management plane of the DrayTek VigorSwitch, which is typically accessible via HTTP or HTTPS over the management network. Privilege requirements are strictly administrative, necessitating valid high-privilege credentials to reach the vulnerable code path through the web interface."
}