CVE Vulnerability Catalog

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the diag_logmail function. The issue is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking remaining space. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The issue is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the acl_general_setup Add ACE function. The issue is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the switch_lan_gvrp function. The issue is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the poe_schedule_profile function. The issue is caused by repeated concatenation of start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the sysreboot function. The issue is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the webBackupAction function. The issue is caused by repeated string concatenation of pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the pingtrace function. The issue is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a command injection vulnerability in the tftp_upgrade function. The issue is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this via crafted input to execute arbitrary commands with root privileges. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a command injection vulnerability in the setTime function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this via crafted input to execute arbitrary commands with root privileges. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The issue is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The issue is caused by missing validation when the pass field is absent. A remote attacker can exploit this via a crafted request to crash the service and cause a denial of service.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The issue is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.