Description (CNA)
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DrayTek Corporation / VigorSwitch G2540xs | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch P2540xs | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch FX2120 | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch G2282x | affected 0 before 2.10.6 |
| DrayTek Corporation / VigorSwitch P2282x | affected 0 before 2.10.6 |
| DrayTek Corporation / VigorSwitch Q2300x | affected 0 before 2.10.7 |
| DrayTek Corporation / VigorSwitch PQ2300xb | affected 0 before 2.10.7 |
| DrayTek Corporation / VigorSwitch G2542x | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch P2542x | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch P2542xh | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch PX2060 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G1280 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1280 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1281x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G1282 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1282 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2121 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2121 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch PQ2121x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch Q2121x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2280x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2280x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch Q2200x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch PQ2200xb | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2100 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2100 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2540x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2540x | affected 0 before 2.9.10 |
CWE
CWE-476
References
- https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
- https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-pre-authentication-null-pointer-dereference-via-setget-cgi
ADP enrichment
No English description supplied.
No references supplied.