CVE-2026-71933 PUBLISHED

DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

Assigner: VulnCheck
Reserved: 08.08.2026 Published: 24.08.2026 Updated: 26.08.2026

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.8

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	DrayTek Corporation
Product	VigorSwitch G2540xs
Versions	Default: unaffected affected from 0 to 3.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2540xs
Versions	Default: unaffected affected from 0 to 3.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch FX2120
Versions	Default: unaffected affected from 0 to 3.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G2282x
Versions	Default: unaffected affected from 0 to 2.10.6 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2282x
Versions	Default: unaffected affected from 0 to 2.10.6 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch Q2300x
Versions	Default: unaffected affected from 0 to 2.10.7 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch PQ2300xb
Versions	Default: unaffected affected from 0 to 2.10.7 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G2542x
Versions	Default: unaffected affected from 0 to 3.10.6 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2542x
Versions	Default: unaffected affected from 0 to 3.10.6 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2542xh
Versions	Default: unaffected affected from 0 to 3.10.6 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch PX2060
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G1280
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P1280
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P1281x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G1282
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P1282
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G2121
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2121
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch PQ2121x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch Q2121x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G2280x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2280x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch Q2200x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch PQ2200xb
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G2100
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2100
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch G2540x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

Vendor	DrayTek Corporation
Product	VigorSwitch P2540x
Versions	Default: unaffected affected from 0 to 2.9.10 (excl.)

CVE-2026-71933 PUBLISHED

DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

Metrics

Product Status

Credits

References

Problem Types