CyberRota Analysis
AI-GeneratedMultiple DrayTek VigorSwitch models are vulnerable due to a directory traversal flaw in the getSyslogFile function, stemming from inadequate validation of the option field. This vulnerability allows a remote attacker with valid administrative credentials to exploit path traversal sequences, potentially accessing arbitrary files on the device. Organizations using these switches should prioritize remediation to mitigate the risk of unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.