Skip to content
OpenAdvisories
Medium · 4.9 CVE-2026-71932 EUVD-2026-64991GHSA-r5v5-f3wg-hpww

DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile

Published Aug 24, 2026 · Updated Aug 24, 2026 · Assigned by VulnCheck

Vendor: DrayTek Product: VigorSwitch FX2120 Product: VigorSwitch G1280 Product: VigorSwitch G1282 Product: VigorSwitch G2100 Product: VigorSwitch G2121 Product: VigorSwitch G2280x Product: VigorSwitch G2282x Product: VigorSwitch G2540x Product: VigorSwitch G2540xs Product: VigorSwitch G2542x Product: VigorSwitch P1280 Product: VigorSwitch P1281x Product: VigorSwitch P1282 Product: VigorSwitch P2100 Product: VigorSwitch P2121 Product: VigorSwitch P2280x Product: VigorSwitch P2282x Product: VigorSwitch P2540x Product: VigorSwitch P2540xs Product: VigorSwitch P2542x Product: VigorSwitch P2542xh Product: VigorSwitch PQ2121x Product: VigorSwitch PQ2200xb Product: VigorSwitch PQ2300xb Product: VigorSwitch PX2060 Product: VigorSwitch Q2121x Product: VigorSwitch Q2200x Product: VigorSwitch Q2300x Category: Network devices

Description

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

VendorProductAffectedFixed
DrayTek VigorSwitch G2540xs < 3.9.10 3.9.10
DrayTek VigorSwitch P2540xs < 3.9.10 3.9.10
DrayTek VigorSwitch FX2120 < 3.9.10 3.9.10
DrayTek VigorSwitch G2282x < 2.10.6 2.10.6
DrayTek VigorSwitch P2282x < 2.10.6 2.10.6
DrayTek VigorSwitch Q2300x < 2.10.7 2.10.7
DrayTek VigorSwitch PQ2300xb < 2.10.7 2.10.7
DrayTek VigorSwitch G2542x < 3.10.6 3.10.6
DrayTek VigorSwitch P2542x < 3.10.6 3.10.6
DrayTek VigorSwitch P2542xh < 3.10.6 3.10.6
DrayTek VigorSwitch PX2060 < 2.9.10 2.9.10
DrayTek VigorSwitch G1280 < 2.9.10 2.9.10
DrayTek VigorSwitch P1280 < 2.9.10 2.9.10
DrayTek VigorSwitch P1281x < 2.9.10 2.9.10
DrayTek VigorSwitch G1282 < 2.9.10 2.9.10
DrayTek VigorSwitch P1282 < 2.9.10 2.9.10
DrayTek VigorSwitch G2121 < 2.9.10 2.9.10
DrayTek VigorSwitch P2121 < 2.9.10 2.9.10
DrayTek VigorSwitch PQ2121x < 2.9.10 2.9.10
DrayTek VigorSwitch Q2121x < 2.9.10 2.9.10
DrayTek VigorSwitch G2280x < 2.9.10 2.9.10
DrayTek VigorSwitch P2280x < 2.9.10 2.9.10
DrayTek VigorSwitch Q2200x < 2.9.10 2.9.10
DrayTek VigorSwitch PQ2200xb < 2.9.10 2.9.10
DrayTek VigorSwitch G2100 < 2.9.10 2.9.10
DrayTek VigorSwitch P2100 < 2.9.10 2.9.10
DrayTek VigorSwitch G2540x < 2.9.10 2.9.10
DrayTek VigorSwitch P2540x < 2.9.10 2.9.10

Advisories 2

References