Vulnerabilities

TI-2026-50238 CVE-2026-71943 · GHSA-hpmr-74gj-7m6c

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50237 CVE-2026-71942 · GHSA-33fw-8wrj-c6pw

DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50236 CVE-2026-71941 · GHSA-2wrc-f39g-cp5h

DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50235 CVE-2026-71940 · GHSA-pfv2-vr3v-8f3r

DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50234 CVE-2026-71939 · GHSA-w265-5q4m-22wq

DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50233 CVE-2026-71938 · GHSA-x775-m3v2-h228

DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50232 CVE-2026-71937 · GHSA-75q7-4wfq-wpxr

DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50231 CVE-2026-71936 · GHSA-v8w8-j3hm-5q73

DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50230 CVE-2026-71935 · GHSA-hc7m-6wqp-3xx8

DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50229 CVE-2026-71934 · GHSA-6w7v-x68g-7x9r

DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace

MEDIUM 40

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00683 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-120

TI-2026-50228 CVE-2026-71933 · GHSA-x2c7-pf46-x3p9

DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

MEDIUM 47

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00553 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-862

TI-2026-50227 CVE-2026-71932 · GHSA-r5v5-f3wg-hpww

DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile

LOW 32

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.01038 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-22

TI-2026-50226 CVE-2026-71931 · GHSA-cppc-jg2v-27ff

DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade

MEDIUM 43

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01783 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50225 CVE-2026-71930 · GHSA-jppm-3g4f-r3x7

DrayTek VigorSwitch Multiple Models OS Command Injection via setTime

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50224 CVE-2026-71929 · GHSA-p299-wp3x-668q

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50223 CVE-2026-71928 · GHSA-q8x9-vhc2-6p4c

DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50222 CVE-2026-71927 · GHSA-84fg-qvhg-whv8

DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50221 CVE-2026-71926 · GHSA-3f7c-qwwm-whmh

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50220 CVE-2026-71925 · GHSA-f6x9-q3vc-f2xw

DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50219 CVE-2026-71924 · GHSA-fx6v-6m5w-g9mj

DrayTek VigorSwitch Multiple Models OS Command Injection via getVid

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50218 CVE-2026-71923 · GHSA-8qhg-cv9c-6cjp

DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50217 CVE-2026-71922 · GHSA-ppwv-q25g-vjpx

DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

MEDIUM 45

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00685 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-476

TI-2026-50216 CVE-2026-71921 · GHSA-c34j-h938-5r57

DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi

MEDIUM 53

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02787 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

TI-2026-50215 CVE-2026-71920 · GHSA-648m-vmc5-h63x

DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

LOW 31

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00556 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-476

TI-2026-50214 CVE-2026-71919 · GHSA-rx95-5fgm-f7j9

DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot

MEDIUM 44

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02265 Published 2026-08-24 Fixed in 3.9.10, 2.10.6 +3 CWE-78

Vulnerabilities

Filters