VDB

CVE-2026-71932

CVE-2026-71932 PUBLISHED CVSS 6.9 MEDIUM

Reported by VulnCheck · Published August 24, 2026

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

Risk Scores

CVSS 4.0
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
DrayTek CorporationVigorSwitch G2540xs0
DrayTek CorporationVigorSwitch P2540xs0
DrayTek CorporationVigorSwitch FX21200
DrayTek CorporationVigorSwitch G2282x0
DrayTek CorporationVigorSwitch P2282x0
DrayTek CorporationVigorSwitch Q2300x0
DrayTek CorporationVigorSwitch PQ2300xb0
DrayTek CorporationVigorSwitch G2542x0
DrayTek CorporationVigorSwitch P2542x0
DrayTek CorporationVigorSwitch P2542xh0
DrayTek CorporationVigorSwitch PX20600
DrayTek CorporationVigorSwitch G12800
DrayTek CorporationVigorSwitch P12800
DrayTek CorporationVigorSwitch P1281x0
DrayTek CorporationVigorSwitch G12820
DrayTek CorporationVigorSwitch P12820
DrayTek CorporationVigorSwitch G21210
DrayTek CorporationVigorSwitch P21210
DrayTek CorporationVigorSwitch PQ2121x0
DrayTek CorporationVigorSwitch Q2121x0

…and 50 more

Timeline

  • Aug 24, 2026 Coalition ESS Score
  • Aug 24, 2026 CVE Published
  • Aug 25, 2026 EPSS Score
  • Aug 26, 2026 CVE Updated
  • Aug 27, 2026 EPSS Score
  • Aug 28, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›