VDB

CVE-2026-71933

CVE-2026-71933 PUBLISHED CVSS 8.8 HIGH

Reported by VulnCheck · Published August 24, 2026

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.

Risk Scores

CVSS 4.0
8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
DrayTek CorporationVigorSwitch G2540xs0
DrayTek CorporationVigorSwitch P2540xs0
DrayTek CorporationVigorSwitch FX21200
DrayTek CorporationVigorSwitch G2282x0
DrayTek CorporationVigorSwitch P2282x0
DrayTek CorporationVigorSwitch Q2300x0
DrayTek CorporationVigorSwitch PQ2300xb0
DrayTek CorporationVigorSwitch G2542x0
DrayTek CorporationVigorSwitch P2542x0
DrayTek CorporationVigorSwitch P2542xh0
DrayTek CorporationVigorSwitch PX20600
DrayTek CorporationVigorSwitch G12800
DrayTek CorporationVigorSwitch P12800
DrayTek CorporationVigorSwitch P1281x0
DrayTek CorporationVigorSwitch G12820
DrayTek CorporationVigorSwitch P12820
DrayTek CorporationVigorSwitch G21210
DrayTek CorporationVigorSwitch P21210
DrayTek CorporationVigorSwitch PQ2121x0
DrayTek CorporationVigorSwitch Q2121x0

…and 50 more

Timeline

  • Aug 24, 2026 Coalition ESS Score
  • Aug 24, 2026 CVE Published
  • Aug 25, 2026 EPSS Score
  • Aug 27, 2026 EPSS Score
  • Sep 1, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›