Executive brief
DrayTek VigorSwitch is a network switching appliance used in enterprise environments to manage and route network traffic. The vulnerable setDevNet function fails to properly sanitize user-supplied input in administrative credentials, allowing an authenticated attacker with valid admin access to inject arbitrary shell commands that execute with root-level privileges, potentially compromising the entire network infrastructure managed by the switch.
Technical details
This is an OS command injection vulnerability (CWE-78) in the setDevNet function within the mainfunction.cgi component of multiple DrayTek VigorSwitch firmware versions. The root cause is insufficient input validation and filtering of the username and password fields before they are passed to command execution routines. An authenticated attacker with valid administrative credentials can craft malicious input containing shell metacharacters to break out of the intended command context and execute arbitrary OS commands with root privileges on the affected device. Exploitation is network-accessible but requires valid admin credentials and authentication to the web management interface. Patches are available in the specified firmware versions for each model.
Affected products
- DrayTek VigorSwitch G2540xs before 3.9.10
- DrayTek VigorSwitch P2540xs before 3.9.10
- DrayTek VigorSwitch FX2120 before 3.9.10
- DrayTek VigorSwitch G2282x before 2.10.6
- DrayTek VigorSwitch P2282x before 2.10.6
- DrayTek VigorSwitch Q2300x before 2.10.7
- DrayTek VigorSwitch PQ2300xb before 2.10.7
- DrayTek VigorSwitch G2542x before 3.10.6
- DrayTek VigorSwitch P2542x before 3.10.6
- DrayTek VigorSwitch P2542xh before 3.10.6
- DrayTek VigorSwitch PX2060 before 2.9.10
- DrayTek VigorSwitch G1280 before 2.9.10
- DrayTek VigorSwitch P1280 before 2.9.10
- DrayTek VigorSwitch P1281x before 2.9.10
- DrayTek VigorSwitch G1282 before 2.9.10
- DrayTek VigorSwitch P1282 before 2.9.10
- DrayTek VigorSwitch G2121 before 2.9.10
- DrayTek VigorSwitch P2121 before 2.9.10
- DrayTek VigorSwitch PQ2121x before 2.9.10
- DrayTek VigorSwitch Q2121x before 2.9.10
- DrayTek VigorSwitch G2280x before 2.9.10
- DrayTek VigorSwitch P2280x before 2.9.10
- DrayTek VigorSwitch Q2200x before 2.9.10
- DrayTek VigorSwitch PQ2200xb before 2.9.10
- DrayTek VigorSwitch G2100 before 2.9.10
- DrayTek VigorSwitch P2100 before 2.9.10
- DrayTek VigorSwitch G2540x before 2.9.10
- DrayTek VigorSwitch P2540x before 2.9.10
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched