CVE-2026-71932
DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 24, 2026
- Updated
- Aug 24, 2026
- Reserved
- Aug 8, 2026
Description
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
VigorSwitch G2540xsDrayTek Corporation |
|
VigorSwitch P2540xsDrayTek Corporation |
|
VigorSwitch FX2120DrayTek Corporation |
|
VigorSwitch G2282xDrayTek Corporation |
|
VigorSwitch P2282xDrayTek Corporation |
|
VigorSwitch Q2300xDrayTek Corporation |
|
VigorSwitch PQ2300xbDrayTek Corporation |
|
VigorSwitch G2542xDrayTek Corporation |
|
VigorSwitch P2542xDrayTek Corporation |
|
VigorSwitch P2542xhDrayTek Corporation |
|
VigorSwitch PX2060DrayTek Corporation |
|
VigorSwitch G1280DrayTek Corporation |
|
VigorSwitch P1280DrayTek Corporation |
|
VigorSwitch P1281xDrayTek Corporation |
|
VigorSwitch G1282DrayTek Corporation |
|
VigorSwitch P1282DrayTek Corporation |
|
VigorSwitch G2121DrayTek Corporation |
|
VigorSwitch P2121DrayTek Corporation |
|
VigorSwitch PQ2121xDrayTek Corporation |
|
VigorSwitch Q2121xDrayTek Corporation |
|
VigorSwitch G2280xDrayTek Corporation |
|
VigorSwitch P2280xDrayTek Corporation |
|
VigorSwitch Q2200xDrayTek Corporation |
|
VigorSwitch PQ2200xbDrayTek Corporation |
|
VigorSwitch G2100DrayTek Corporation |
|
VigorSwitch P2100DrayTek Corporation |
|
VigorSwitch G2540xDrayTek Corporation |
|
VigorSwitch P2540xDrayTek Corporation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.