CyberRota Analysis
AI-GeneratedMultiple DrayTek VigorSwitch models are vulnerable to a buffer overflow in the mail_mailalert function, which occurs when concatenating multiple SMTP receiver email addresses into a fixed-size buffer without proper size checks. This vulnerability can be exploited by a remote attacker with valid administrative credentials, potentially leading to denial of service or arbitrary command execution. Organizations using affected VigorSwitch models should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.