Pre-authentication Null Pointer Dereference in DrayTek VigorSwitch

Executive Summary

This is a pre-authentication null pointer dereference vulnerability in multiple DrayTek VigorSwitch models. It occurs in the setget.cgi interface due to missing validation when the 'pass' field is absent in a request. An unauthenticated remote attacker can exploit this by sending a crafted request to crash the service, causing a denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, scan your network for DrayTek VigorSwitch devices and check if they expose the setget.cgi interface. Use tools like Nmap to identify affected devices by searching for open ports and HTTP services. Example command: nmap -p 80,443 <target_IP> --script http-enum. Look for responses from setget.cgi without requiring authentication.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to remotely crash the affected DrayTek VigorSwitch devices, leading to service disruption and potential network downtime. Since it is pre-authentication, no credentials are required to exploit it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by crashing the service via crafted requests, which could disrupt network operations. For compliance with standards like GDPR or HIPAA, availability of systems is critical. Downtime or service disruption may lead to non-compliance with availability requirements, potentially resulting in violations if sensitive data processing or network services are interrupted.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected DrayTek VigorSwitch devices to the latest firmware versions provided by DrayTek. If updates are unavailable, restrict access to the setget.cgi interface via network firewalls or disable the interface if possible. Monitor network traffic for unusual requests targeting this interface.

Useful 0 Not Useful 0