Skip to content
OpenAdvisories
High NCSC-2026-0328 29 CVEs

Kwetsbaarheden verholpen in DrayTek VigorSwitch

Published Aug 26, 2026 · Updated Aug 26, 2026 · nl

Vendor: DrayTek Product: Vigor Product: VigorSwitch FX2120 Product: VigorSwitch G1280 Product: VigorSwitch G1282 Product: VigorSwitch G2100 Product: VigorSwitch G2121 Product: VigorSwitch G2280x Product: VigorSwitch G2282x Product: VigorSwitch G2540x Product: VigorSwitch G2540xs Product: VigorSwitch G2542x Product: VigorSwitch P1280 Product: VigorSwitch P1281x Product: VigorSwitch P1282 Product: VigorSwitch P2100 Product: VigorSwitch P2121 Product: VigorSwitch P2280x Product: VigorSwitch P2282x Product: VigorSwitch P2540x Product: VigorSwitch P2540xs Product: VigorSwitch P2542x Product: VigorSwitch P2542xh Product: VigorSwitch PQ2121x Product: VigorSwitch PQ2200xb Product: VigorSwitch PQ2300xb Product: VigorSwitch PX2060 Product: VigorSwitch Q2121x Product: VigorSwitch Q2200x Product: VigorSwitch Q2300x

Summary

DrayTek heeft meerdere kwetsbaarheden verholpen in de VigorSwitch productlijn.

Details

Interpretaties
De kwetsbaarheden betreffen voornamelijk command injection, buffer overflow, null pointer dereference, directory traversal en onvoldoende autorisatiecontroles in diverse functies van de DrayTek VigorSwitch apparaten. Command injection kwetsbaarheden bevinden zich onder andere in functies zoals jsonstatus, commandTable, pingtrace, webBackupAction, sysreboot, auth_set, getVid, getDetail, setDevice, rebDevice, fdftDevice, setDevProto, setTime, tftp_upgrade en setDevNet. Deze maken het mogelijk voor een aanvaller om willekeurige commando's met root privileges uit te voeren. Sommige command injection kwetsbaarheden zijn pre-authenticatie, zoals in de setget.cgi interface, waardoor geen voorafgaande authenticatie vereist is voor exploitatie.

Buffer overflow kwetsbaarheden zijn aanwezig in functies zoals pingtrace, webBackupAction, sysreboot, poe_schedule_profile, switch_lan_gvrp, acl_general_setup Add ACE en Edit ACE, diag_logmail en mail_mailalert. Deze kunnen leiden tot denial of service of uitvoering van willekeurige code onder administratieve rechten.

Null pointer dereference kwetsbaarheden in formlogout en setget.cgi kunnen leiden tot een denial of service door het crashen van de service.

Directory traversal in getSyslogFile maakt het mogelijk om, mits geauthenticeerd, toegang te krijgen tot willekeurige bestanden op het systeem. Onvoldoende autorisatiecontroles in syslog functies stellen een aanvaller in staat om configuraties te wijzigen, services te herstarten, configuraties op te slaan of logs te wissen zonder de juiste rechten.

Exploitatie van deze kwetsbaarheden vereist in de meeste gevallen geldige administratieve credentials, behalve bij de pre-authenticatie command injection en null pointer dereference in setget.cgi.

Oplossingen
DrayTek heeft updates uitgebracht om de kwetsbaarheden in de VigorSwitch productlijn te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 29

  • Critical 9.8
    CVE-2026-71921

    DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi

    Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this …

    DrayTek VigorSwitch PQ2121x VigorSwitch FX2120 VigorSwitch G1280 Network devices
  • Critical 9.1
    CVE-2026-71933

    DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

    Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify co…

    DrayTek VigorSwitch P2542x VigorSwitch G2100 VigorSwitch P2540xs Network devices
  • High 7.5
    CVE-2026-71922

    DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

    Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerabil…

    DrayTek VigorSwitch G1282 VigorSwitch PQ2200xb VigorSwitch G2542x Network devices
  • High 7.2
    CVE-2026-71915

    DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigge…

    DrayTek VigorSwitch P2282x VigorSwitch G2280x VigorSwitch P1281x Network devices
  • High 7.2
    CVE-2026-71916

    DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter f…

    DrayTek VigorSwitch G2121 VigorSwitch G2540xs VigorSwitch P2100 Network devices
  • High 7.2
    CVE-2026-71917

    DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via cr…

    DrayTek VigorSwitch FX2120 VigorSwitch PQ2121x VigorSwitch G1280 Network devices
  • High 7.2
    CVE-2026-71918

    DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote att…

    DrayTek VigorSwitch FX2120 VigorSwitch PQ2121x VigorSwitch G1280 Network devices
  • High 7.2
    CVE-2026-71919

    DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger…

    DrayTek VigorSwitch P2282x VigorSwitch G2280x VigorSwitch P1281x Network devices
  • High 7.2
    CVE-2026-71923

    DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vuln…

    DrayTek VigorSwitch P2542x VigorSwitch G2100 VigorSwitch P2121 Network devices
  • High 7.2
    CVE-2026-71924

    DrayTek VigorSwitch Multiple Models OS Command Injection via getVid

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulner…

    DrayTek VigorSwitch G2540x VigorSwitch PX2060 VigorSwitch G2282x Network devices
  • High 7.2
    CVE-2026-71925

    DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul…

    DrayTek VigorSwitch Q2200x VigorSwitch PQ2300xb VigorSwitch P1282 Network devices
  • High 7.2
    CVE-2026-71926

    DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can tr…

    DrayTek VigorSwitch PX2060 VigorSwitch G2540x VigorSwitch G2282x Network devices
  • High 7.2
    CVE-2026-71927

    DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul…

    DrayTek VigorSwitch G2540xs VigorSwitch G2121 VigorSwitch P2542xh Network devices
  • High 7.2
    CVE-2026-71928

    DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vu…

    DrayTek VigorSwitch G2540x VigorSwitch PX2060 VigorSwitch Q2121x Network devices
  • High 7.2
    CVE-2026-71929

    DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this v…

    DrayTek VigorSwitch G2540xs VigorSwitch G2121 VigorSwitch P2100 Network devices
  • High 7.2
    CVE-2026-71930

    DrayTek VigorSwitch Multiple Models OS Command Injection via setTime

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulne…

    DrayTek VigorSwitch PQ2300xb VigorSwitch Q2200x VigorSwitch P1282 Network devices
  • High 7.2
    CVE-2026-71931

    DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vuln…

    DrayTek VigorSwitch G2280x VigorSwitch P2282x VigorSwitch P1281x Network devices
  • High 7.2
    CVE-2026-71934

    DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker …

    DrayTek VigorSwitch FX2120 VigorSwitch PQ2121x VigorSwitch P2540x Network devices
  • High 7.2
    CVE-2026-71935

    DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total …

    DrayTek VigorSwitch P1280 VigorSwitch P2280x VigorSwitch Q2300x Network devices
  • High 7.2
    CVE-2026-71936

    DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via craf…

    DrayTek VigorSwitch P1280 VigorSwitch Q2300x VigorSwitch P2280x Network devices
  • High 7.2
    CVE-2026-71937

    DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_…

    DrayTek VigorSwitch G2280x VigorSwitch P2282x VigorSwitch P1281x Network devices
  • High 7.2
    CVE-2026-71938

    DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via cr…

    DrayTek VigorSwitch P1280 VigorSwitch Q2300x VigorSwitch P2280x Network devices
  • High 7.2
    CVE-2026-71939

    DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this…

    DrayTek VigorSwitch G1282 VigorSwitch G2542x VigorSwitch PQ2200xb Network devices
  • High 7.2
    CVE-2026-71940

    DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger thi…

    DrayTek VigorSwitch P2542x VigorSwitch G2100 VigorSwitch P2540xs Network devices
  • High 7.2
    CVE-2026-71941

    DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A…

    DrayTek VigorSwitch G2121 VigorSwitch G2540xs VigorSwitch P2542xh Network devices
  • High 7.2
    CVE-2026-71942

    DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert

    Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size.…

    DrayTek VigorSwitch PQ2300xb VigorSwitch Q2200x VigorSwitch P1282 Network devices
  • High 7.2
    CVE-2026-71943

    DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet

    Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul…

    DrayTek VigorSwitch G1282 VigorSwitch G2542x VigorSwitch PQ2200xb Network devices
  • Medium 4.9
    CVE-2026-71920

    DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

    Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vuln…

    DrayTek VigorSwitch P1280 VigorSwitch Q2300x VigorSwitch P2280x Network devices
  • Medium 4.9
    CVE-2026-71932

    DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile

    Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input conta…

    DrayTek VigorSwitch G1282 VigorSwitch G2542x VigorSwitch PQ2200xb Network devices

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-acl-general-setup-add-ace
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-acl-general-setup-edit-ace
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-diag-logmail
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-mail-mailalert
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-pingtrace
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-poe-schedule-profile
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-switch-lan-gvrp
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-sysreboot
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-webbackupaction
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-missing-authorization-in-syslog-functions
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-null-pointer-dereference-via-formlogout
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-auth-set
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-commandtable
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-fdftdevice
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-getdetail
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-getvid
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-jsonstatus
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-pingtrace
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-rebdevice
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-setdevice
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-setdevnet
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-setdevproto
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-settime
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-sysreboot
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-tftp-upgrade
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-webbackupaction
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-path-traversal-via-getsyslogfile
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-pre-authentication-null-pointer-dereference-via-setget-cgi
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-pre-authentication-os-command-injection-via-setget-cgi