Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:19.877Z",
  "pubdate": "2026-08-24T18:17:19.877Z",
  "executiveSummary": "A buffer overflow vulnerability has been identified in multiple DrayTek VigorSwitch models. The security flaw specifically resides within the mail_mailalert function of the device firmware.\nThe vulnerability is triggered by the insecure concatenation of multiple smtpReceiver email address parameters into a statically allocated, fixed-size destination buffer without performing adequate bounds checking or length validation.\nExploitation of this vulnerability allows a remote authenticated attacker to induce a denial of service state or potentially achieve arbitrary command execution on the underlying operating system.\nSuccessful exploitation of the target network device requires the attacker to possess valid administrative credentials granting access to the web management interface of the affected DrayTek VigorSwitch.\nThe inherent risks include complete compromise of the network switch control plane, loss of availability, and potential lateral movement into connected network segments if arbitrary code execution is successfully achieved.\nOrganizations deploying impacted DrayTek VigorSwitch models must treat administrative credential management and access control as critical security vectors to mitigate unauthorized exploitation of this management interface vulnerability.",
  "technicalDetails": "The vulnerability is classified as a classic stack-based or heap-based buffer overflow within the mail_mailalert function responsible for handling email alert configurations on DrayTek VigorSwitch models.\nThe root cause of the vulnerability stems from inadequate input validation and the absence of bounded string manipulation functions (such as strncpy or snprintf) when processing configuration parameters.\nSpecifically, the application takes multiple smtpReceiver email address strings supplied by the user and concatenates them sequentially into a fixed-size buffer allocated in memory.\nBecause the length of the incoming smtpReceiver input is not validated against the remaining capacity of the destination buffer, an attacker can supply excessively long or crafted string inputs that exceed the buffer boundaries.\nWriting beyond the allocated bounds of the buffer results in the corruption of adjacent memory structures, including saved frame pointers, return addresses, or adjacent control variables, depending on the memory layout.\nThe attack flow begins when an authenticated user or an attacker leveraging compromised administrative credentials navigates to the email alert configuration section of the web management interface.\nThe attacker submits a crafted HTTP request containing malicious input parameters designed to trigger the vulnerable mail_mailalert function during the processing or saving of the smtpReceiver email configuration.\nUpon processing the oversized input, the lack of boundary checks causes the internal buffer to overflow, overwriting critical execution context memory.\nIf the overwritten memory includes the return address of the function, the instruction pointer can be redirected upon function return, potentially allowing the execution of arbitrary shell commands or payload instructions embedded within the crafted input.\nAlternatively, if memory corruption destabilizes critical application data structures, the device encounters an unhandled exception or crash, resulting in a denial of service condition requiring a physical or remote power cycle.\nNetwork exposure is restricted to the web management interface of the DrayTek VigorSwitch, which may be accessible via HTTP or HTTPS protocols.\nAuthentication requirements dictate that the attacker must already possess valid administrative credentials to access the web management interface and reach the vulnerable mail_mailalert code path, meaning unauthenticated attackers cannot directly exploit this flaw without prior credential compromise."
}