CVE-2026-71920
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.
- Score
- CVSS 4.0 6.9 Medium
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-08-24
- Last modified
- 2026-10-13
- Weaknesses
- CWE-476
Affected products
- Vigorswitch Fx2120 Firmware (Draytek)
- Vigorswitch G1282 Firmware (Draytek)
- Vigorswitch G2100 Firmware (Draytek)
- Vigorswitch G2121 Firmware (Draytek)
- Vigorswitch G2280x Firmware (Draytek)
- Vigorswitch G2540xs Firmware (Draytek)
- Vigorswitch P1282 Firmware (Draytek)
- Vigorswitch P2100 Firmware (Draytek)
- Vigorswitch P2280x Firmware (Draytek)
- Vigorswitch P2540xs Firmware (Draytek)
- Vigorswitch Pq2121x Firmware (Draytek)
- Vigorswitch Pq2200xb Firmware (Draytek)
- Vigorswitch Q2121x Firmware (Draytek)
- Vigorswitch Q2200x Firmware (Draytek)
References
- https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
- https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-null-pointer-dereference-via-formlogout
