NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in DrayTek VigorSwitch
view advisory published 2026-08-26
DrayTek heeft meerdere kwetsbaarheden verholpen in de VigorSwitch productlijn.
01
describes (29)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-71943US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and p… | ||||
| CVE-2026-71942US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email… | ||||
| CVE-2026-71941US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email a… | ||||
| CVE-2026-71940US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a… | ||||
| CVE-2026-71939US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a… | ||||
| CVE-2026-71938US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field int… | ||||
| CVE-2026-71937US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start… | ||||
| CVE-2026-71936US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into… | ||||
| CVE-2026-71935US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pat… | ||||
| CVE-2026-71934US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, an… | ||||
| CVE-2026-71933US | critical9.1OT elevated | — | ||
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remo… | ||||
| CVE-2026-71932US | medium4.9 | — | ||
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option… | ||||
| CVE-2026-71931US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filenam… | ||||
| CVE-2026-71930US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and pas… | ||||
| CVE-2026-71929US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and… | ||||
| CVE-2026-71928US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and… | ||||
| CVE-2026-71927US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and p… | ||||
| CVE-2026-71926US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, p… | ||||
| CVE-2026-71925US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and p… | ||||
| CVE-2026-71924US | high7.2 | — | ||
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and pass… | ||||
showing 20 of 29
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan