Directory Traversal in DrayTek VigorSwitch

Executive Summary

This is a path traversal vulnerability in multiple DrayTek VigorSwitch models. It exists in the getSyslogFile function due to insufficient validation of the option field. A remote attacker can exploit this by sending crafted input with path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the web management interface.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if any DrayTek VigorSwitch models (e.g., G2540xs, P2540xs, FX2120, G2282x) are running vulnerable firmware versions. Inspect web management interface logs for unusual file access patterns or path traversal attempts in the getSyslogFile function. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access sensitive files on the device, potentially exposing configuration data, logs, or other confidential information. This could lead to further attacks or unauthorized access to the network if the device is compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Organizations may face legal and regulatory penalties if such breaches occur due to inadequate security measures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected DrayTek VigorSwitch models to the latest firmware version. Ensure administrative credentials for the web management interface are strong and not shared. Restrict access to the web interface to trusted networks or IP addresses.

Useful 0 Not Useful 0