Riskcovery

CVE-2026-71922

DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

State
Published
Severity
8.7 High
Published
Aug 24, 2026
Updated
Aug 24, 2026
Reserved
Aug 8, 2026

Read the record on cve.org

Description

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NVulnCheck
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HVulnCheck

Weaknesses

Affected Products

ProductVersions
VigorSwitch G2540xsDrayTek Corporation
  • before 3.9.10Affected
VigorSwitch P2540xsDrayTek Corporation
  • before 3.9.10Affected
VigorSwitch FX2120DrayTek Corporation
  • before 3.9.10Affected
VigorSwitch G2282xDrayTek Corporation
  • before 2.10.6Affected
VigorSwitch P2282xDrayTek Corporation
  • before 2.10.6Affected
VigorSwitch Q2300xDrayTek Corporation
  • before 2.10.7Affected
VigorSwitch PQ2300xbDrayTek Corporation
  • before 2.10.7Affected
VigorSwitch G2542xDrayTek Corporation
  • before 3.10.6Affected
VigorSwitch P2542xDrayTek Corporation
  • before 3.10.6Affected
VigorSwitch P2542xhDrayTek Corporation
  • before 3.10.6Affected
VigorSwitch PX2060DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch G1280DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P1280DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P1281xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch G1282DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P1282DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch G2121DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P2121DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch PQ2121xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch Q2121xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch G2280xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P2280xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch Q2200xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch PQ2200xbDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch G2100DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P2100DrayTek Corporation
  • before 2.9.10Affected
VigorSwitch G2540xDrayTek Corporation
  • before 2.9.10Affected
VigorSwitch P2540xDrayTek Corporation
  • before 2.9.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.