Xiapu Luo

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `pingtrace` function due to insufficient validation of the `host` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A pre-authentication null pointer dereference occurs in the 'setget.cgi' interface. This issue stems from missing validation when the `pass` field is absent. A remote attacker can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `dray apm` component. The flaw stems from insufficient validation of UDP message content following a `START SPEED TEST` request before the system executes commands. A remote attacker can exploit this by sending a specially crafted message to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `commandTable()` function. The flaw stems from incomplete filtering of dangerous characters, including backticks, newline characters, and single quotes, within the `parameter` field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `sysreboot()` function. The flaw stems from insufficient filtering of the `config`, `act`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A pre-authentication command injection issue exists in the 'setget.cgi' interface. The flaw stems from insufficient filtering of the `pass` field before command execution, allowing a remote attacker to execute arbitrary commands with root privileges via crafted input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A buffer overflow exists in the `setLan()` function due to missing length checks during memory copy operations. This issue affects the `lanVlanId0`, `lanIp`, and `lanNetmask` fields. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to cause a denial of service or execute arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `apautotest()` function. The flaw stems from insufficient validation of the `CMD0`, `CMD3`, and `CMD6` fields before they are executed as commands. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `apautotest()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the 'upload settings.cgi' interface. The flaw occurs due to insufficient filtering of the `restorekey` field before it is concatenated into a shell command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `jsonstatus()` function. The flaw stems from insufficient filtering of the `usescript`, `usefile`, and `option` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `webBackupAction()` function. The flaw stems from insufficient filtering of the `option`, `key`, `pw encode`, `pathN`, and `valueN` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Volmarg Personal Management System (affected versions not specified) DrayTek VigorAP (affected versions not specified) **Description** Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET /public/get-file/{path}' endpoint. The `path` route parameter is passed to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form, allowing the retrieval of sensitive files accessible to the PHP-FPM worker process. DrayTek VigorAP models contain a command injection flaw in the `ExportSettings()` function. Insufficient filtering of the `backupkey`, `backuptype`, and `realtime` fields allows a remote attacker with administrative credentials to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `tr069TestInform()` function. The flaw arises from insufficient filtering of dangerous characters before the `event code` field is concatenated into a system command. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A null pointer dereference occurs in the `formlogout()` function due to missing checks for an empty or absent Cookie header before string handling. A remote attacker with valid administrative credentials for the web management interface can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `setcamset()` function. The flaw stems from insufficient filtering of the `selectSlaves` field before command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `setLan()` function. The flaw stems from insufficient validation of the `lanIp` and `lanNetmask` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `mesh start speed test()` function. The flaw stems from insufficient sanitization of the `meshdevice index` and `meshdevice ip` variables before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A command injection issue exists in the `InquierTime()` function. The flaw stems from insufficient filtering of the `time` field before it is used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorAP (affected versions not specified) **Description** A buffer overflow exists in the `apautotest()` function. The issue stems from missing length checks during memory copy operations involving the `CMD6` field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to trigger a denial of service or execute arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DrayTek VigorSwitch (affected versions not specified) **Description** A command injection issue exists in the `auth set()` function. The flaw stems from insufficient filtering of the `username` and `password` fields before they are used in command execution. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges. Command injection is a flaw that allows an attacker to execute unauthorized operating system commands on the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.