CVE Feed

    Dashboard / CVE / CVE-2026-71933

    CVE-2026-71933

    Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.

    Published:Aug 24, 2026
    Last Modified:Aug 26, 2026
    EPS:Aug 24, 2026
    EPSS Score:0.00379
    CVSS Score:9.1

    Affected Products

    Vendor
    Draytek
    Product
    Vigorswitch Fx2120 Firmware
    Vendor
    Draytek
    Product
    Vigorswitch G1282 Firmware
    Vendor
    Draytek
    Product
    Vigorswitch G2100 Firmware
    Vendor
    Draytek
    Product
    Vigorswitch G2121 Firmware
    Vendor
    Draytek
    Product
    Vigorswitch G2280x Firmware
    Vendor
    Draytek
    Product
    Vigorswitch G2540xs Firmware
    Vendor
    Draytek
    Product
    Vigorswitch P1282 Firmware
    Vendor
    Draytek
    Product
    Vigorswitch P2100 Firmware
    Vendor
    Draytek
    Product
    Vigorswitch P2280x Firmware
    Vendor
    Draytek
    Product
    Vigorswitch P2540xs Firmware
    Vendor
    Draytek
    Product
    Vigorswitch Pq2121x Firmware
    Vendor
    Draytek
    Product
    Vigorswitch Pq2200xb Firmware
    Vendor
    Draytek
    Product
    Vigorswitch Q2121x Firmware
    Vendor
    Draytek
    Product
    Vigorswitch Q2200x Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-71943 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The v…
    CVE-2026-71942 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. Th…
    CVE-2026-71941 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The …
    CVE-2026-71940 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE …
    CVE-2026-71939 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE f…
    CVE-2026-71938 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. T…
    CVE-2026-71937 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile functi…
    CVE-2026-71936 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vul…
    CVE-2026-71935 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. T…
    CVE-2026-71934 (CVSS 8.6) — Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vul…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High