Command Injection in DrayTek VigorSwitch

Executive Summary

This is an OS command injection vulnerability in multiple DrayTek VigorSwitch models. It exists in the setTime function due to insufficient filtering of username and password fields. A remote attacker with valid admin credentials can exploit this to execute arbitrary commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if any DrayTek VigorSwitch models (e.g., G2540xs, P2540xs, FX2120) are running vulnerable firmware versions. Inspect web interface login fields for improper input validation in the setTime function. Use network scanning tools to identify affected devices by their CPE identifiers.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected DrayTek VigorSwitch model, an attacker with admin access could take full control of your device. This may lead to network compromise, data theft, or disruption of network services. The attacker could install malware, modify configurations, or pivot to other systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected DrayTek VigorSwitch devices to the latest firmware provided by DrayTek. Restrict administrative access to the web interface using strong credentials and network segmentation. Monitor for suspicious activity in device logs and disable unused services.

Useful 0 Not Useful 0