Description (CNA)
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DrayTek Corporation / VigorSwitch G2540xs | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch P2540xs | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch FX2120 | affected 0 before 3.9.10 |
| DrayTek Corporation / VigorSwitch G2282x | affected 0 before 2.10.6 |
| DrayTek Corporation / VigorSwitch P2282x | affected 0 before 2.10.6 |
| DrayTek Corporation / VigorSwitch Q2300x | affected 0 before 2.10.7 |
| DrayTek Corporation / VigorSwitch PQ2300xb | affected 0 before 2.10.7 |
| DrayTek Corporation / VigorSwitch G2542x | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch P2542x | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch P2542xh | affected 0 before 3.10.6 |
| DrayTek Corporation / VigorSwitch PX2060 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G1280 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1280 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1281x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G1282 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P1282 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2121 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2121 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch PQ2121x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch Q2121x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2280x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2280x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch Q2200x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch PQ2200xb | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2100 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2100 | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch G2540x | affected 0 before 2.9.10 |
| DrayTek Corporation / VigorSwitch P2540x | affected 0 before 2.9.10 |
CWE
CWE-862
References
- https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
- https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-missing-authorization-in-syslog-functions
ADP enrichment
No English description supplied.
No references supplied.