Description (CNA)
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DrayTek Corporation / VigorSwitch G2540xs | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch P2540xs | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch FX2120 | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch G2282x | affected 0 before 2.10.6 |
| DrayTek Corporation / VigorSwitch P2282x | affected 0 before 2.10.6 |
| DrayTek Corporation / VigorSwitch Q2300x | affected 0 before 2.10.7 |
| DrayTek Corporation / VigorSwitch PQ2300xb | affected 0 before 2.10.7 |
| DrayTek Corporation / VigorSwitch G2542x | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch P2542x | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch P2542xh | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch PX2060 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G1280 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1280 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1281x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G1282 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1282 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2121 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2121 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch PQ2121x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch Q2121x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2280x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2280x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch Q2200x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch PQ2200xb | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2100 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2100 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2540x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2540x | affected 0 before 2.9.10 |
CWE
CWE-78
References
- https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
- https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-webbackupaction
ADP enrichment
No English description supplied.
No references supplied.