Command Injection in DrayTek VigorSwitch

Executive Summary

This is an OS command injection vulnerability in multiple DrayTek VigorSwitch models. It exists in the rebDevice function due to insufficient filtering of username and password fields. A remote attacker with valid admin credentials can exploit this to execute arbitrary commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking if any DrayTek VigorSwitch models are present on your network. Inspect the web management interface for the affected models (e.g., G2540xs, P2540xs, FX2120) and verify if the firmware versions match those listed as vulnerable in DrayTek's advisory.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of affected DrayTek VigorSwitch devices, leading to potential network compromise, data theft, or disruption of network services. Since exploitation requires admin credentials, the risk is higher if credentials are weak or exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected devices may face compliance violations and potential penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware of all affected DrayTek VigorSwitch models to the latest non-vulnerable version as specified in DrayTek's security advisory. Ensure administrative credentials for the web management interface are strong and not reused across systems.

Useful 0 Not Useful 0