Null Pointer Dereference in DrayTek VigorSwitch Web Interface

Executive Summary

This vulnerability is a null pointer dereference flaw in multiple DrayTek VigorSwitch models. It occurs in the formlogout function due to missing checks for an empty or absent Cookie header before string handling. An attacker with valid admin credentials can exploit it by sending a crafted request to crash the service and cause a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for affected DrayTek VigorSwitch models with outdated firmware. Monitor network traffic for crafted requests targeting the formlogout function. Use administrative access to verify firmware versions against vendor advisories.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can crash the web management interface of affected DrayTek VigorSwitch devices, leading to a denial of service. This disrupts network management and could cause temporary loss of device control for administrators.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks on network infrastructure devices like DrayTek VigorSwitch models. Downtime or disruption of network services may lead to unauthorized access or data processing interruptions, potentially violating availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected DrayTek VigorSwitch devices to the latest firmware versions provided by the vendor. Ensure strong administrative credentials are used and disable unnecessary web management access. Monitor devices for unusual crashes or service disruptions.

Useful 0 Not Useful 0