Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:20.077Z",
  "pubdate": "2026-08-24T18:17:20.077Z",
  "executiveSummary": "Multiple DrayTek VigorSwitch models suffer from a critical command injection vulnerability located within the setDevNet function of the device management interface.\nThe security flaw stems from inadequate input sanitization and filtering applied to administrative parameters, specifically the username and password fields, prior to execution by the underlying operating system shell.\nSuccessful exploitation of this vulnerability allows a remote attacker to achieve arbitrary command execution with elevated root privileges on the targeted network device.\nThe risk implications are severe, as an attacker gaining root-level access can compromise the entire integrity, confidentiality, and availability of the affected switch and potentially pivot deeper into the connected local area network.\nPrerequisites for a successful attack require the adversary to possess valid administrative credentials to access the device's web management interface, limiting unauthenticated exploitation but posing a significant threat regarding credential misuse, session hijacking, or secondary access vectors.",
  "technicalDetails": "The vulnerability resides in multiple DrayTek VigorSwitch models within the setDevNet function, which handles network device configuration tasks via the web management interface.\nThe root cause of the vulnerability is insufficient input validation, sanitization, and filtering of user-supplied data in the username and password fields before passing these parameters into system-level execution routines.\nWhen a user or administrator submits data to the setDevNet function, the application constructs a system command utilizing the unsanitized input from the authentication fields.\nBecause the input handling logic fails to strip or escape shell metacharacters, an attacker can append malicious OS command sequences directly to the username or password parameters.\nThe attack flow begins with the adversary authenticating or leveraging existing administrative credentials to access the device's web management interface.\nThe attacker then crafts a malicious HTTP request targeting the vulnerable setDevNet endpoint, embedding an injection payload within the username or password fields.\nUpon receiving the request, the affected component processes the payload and passes the unvalidated input to the underlying operating system shell for execution.\nDue to the execution context of the management daemon, the injected commands are executed with root privileges, granting the attacker complete administrative control over the underlying operating system.\nThe network exposure includes remote accessibility via the web management interface, typically exposed over HTTP or HTTPS across management networks.\nPost-exploitation impact includes persistent compromise of the DrayTek VigorSwitch, potential interception or manipulation of network traffic traversing the device, installation of backdoors, and the execution of lateral movement attacks against other hosts residing on the local network segments managed by the switch."
}